MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5339a5806401158371e58dfa7357ccf087501f0546467103adb2aa0a61136118. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5339a5806401158371e58dfa7357ccf087501f0546467103adb2aa0a61136118
SHA3-384 hash: 80beff8841c4ef5562db9fa866b95cf25406c71b0631e7d4e1d13ba06135798f82a0de0043f3bba69223bc1ce7c114c1
SHA1 hash: 4099aee5829ccbe1835a472bc1b4d8b983c75e55
MD5 hash: 364a190f928ecec0e45fa50c60c51c77
humanhash: romeo-xray-salami-purple
File name:Strong interest in purchasing of your products for EXPORT 2, with IMG. And Video demo.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-11-26 19:29:38 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:wwHEQEbIkpehwqJtkQkQCdgu0hJEq9K/KFT5V4dLydjsk+x32oIGXxN5ZGIx4jwE:N0bIpwqLkR/KsKT5o6wkiF
TLSH 6E454A8567501F2CF90F0E36EC502E64156FAF977C99F3CE6994BC413A326E1B922983
Reporter cocaman
Tags:AgentTesla img


Avatar
cocaman
Malicious email (T1566.001)
From: "sale@tinyin.com.hk" (likely spoofed)
Received: "from tinyin.com.hk (unknown [45.35.101.8]) "
Date: "26 Nov 2020 13:37:49 -0500"
Subject: "Re:Re: Strong interest in purchasing of your products for EXPORT 2, with IMG. And Video demo"
Attachment: "Strong interest in purchasing of your products for EXPORT 2, with IMG. And Video demo.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5339a5806401158371e58dfa7357ccf087501f0546467103adb2aa0a61136118/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-26 03:24:56 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=km42ladeaekyg4pfrx5hgv6m6cdvahyfizdhca5nwkvauyitmema._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5339a5806401158371e58dfa7357ccf087501f0546467103adb2aa0a61136118

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 5339a5806401158371e58dfa7357ccf087501f0546467103adb2aa0a61136118

(this sample)

AgentTesla

Executable exe 931b74dae99d57d93b21fb72c0da9184b83e04f95e024e9a7990a6c57a73ac7e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 931b74dae99d57d93b21fb72c0da9184b83e04f95e024e9a7990a6c57a73ac7e
  
Dropping
AgentTesla

Comments