MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5477593613f0a66521a902329f246b75d472c75c8295df6f27f0154b31e80b7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5477593613f0a66521a902329f246b75d472c75c8295df6f27f0154b31e80b7a
SHA3-384 hash: 0d800346390e52da900e37b51a63d6dbff6e679fe97cd2a3828ada790779ed965ad780ec7f57b21ad6543fb31ee4cc3a
SHA1 hash: 0d461f94f2f5665cf7023fae114e60e0c52081a4
MD5 hash: 4d962b26a871dc4a69bcd14648a4c18d
humanhash: juliet-butter-nevada-carolina
File name:Orden de compra no699340.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-10 06:58:42 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:D6JUK/G4psE/FvNsSyeqSNM9YCMPRg02DhRCUf2hC:D6J/KE1NVyeHuWgxDhUUf
TLSH 3D450249E580B417DABF0BB495E7C85837F8D6B2502082297DAC2F8CEF455533DAA0DE
Reporter abuse_ch
Tags:AgentTesla Hostwinds img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hwsrv-785563.hostwindsdns.com
Sending IP: 192.255.235.153
From: Cuentas lopez <Cuentas@afglogistics.in>
Reply-To: george@chenklins.com
Subject: Re:PURCHASE ORDER
Attachment: Orden de compra no699340.img (contains "Orden de compra no699340.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5477593613f0a66521a902329f246b75d472c75c8295df6f27f0154b31e80b7a/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-10 00:46:46 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kr3vsnqt6ctgkinjaizj6jdloxkhfr24qkk563zh6akuwmpibn5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5477593613f0a66521a902329f246b75d472c75c8295df6f27f0154b31e80b7a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 5477593613f0a66521a902329f246b75d472c75c8295df6f27f0154b31e80b7a

(this sample)

AgentTesla

Executable exe ebd3b02ed48faa6cc3be453b60cd4ae61a181cb6e06eb7c115b39b004e99aad7

  
Dropping
MD5 30012118756de7f7d9dc3abb787cf462
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ebd3b02ed48faa6cc3be453b60cd4ae61a181cb6e06eb7c115b39b004e99aad7

Comments