MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c77984bc30ac4a91062acee8ad0106c5069b9cf5747c84dae5c1e5aaa87a509. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c77984bc30ac4a91062acee8ad0106c5069b9cf5747c84dae5c1e5aaa87a509
SHA3-384 hash: ab41ddb442ebf420498854580fa2a1e911f452e9b8a9c433d2a070fcf83efc6cbfa5e11db5086c56d8bb44ce2a78a8cd
SHA1 hash: ecfc972c7db41e50a737cee6ab57f1a0811f93d8
MD5 hash: f38f194d27464d61d8cf09dcfd5274be
humanhash: helium-black-ten-earth
File name:POn° 812901.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:631'288 bytes
First seen:2020-08-03 12:46:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:PLUuwQMaw+uJD7GaVE0a+M96euFGsoKmCTijMpawYTik53Ms9NjWWTHCmEgZ:PLUcMr7PSrqvgsoKmaigpa1ikVMsrjW2
TLSH 67D4235890FFC325FBB9C8DC41C70494E58D6E885E8F7EE9E5A03AE348375C86998B05
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: qq.com
Sending IP: 183.3.226.209
From: ll.zhou <ll.zhou@xunjet.com>
Subject: Request Quote
Attachment: POn° 812901.zip (contains "POn° 812901_xlx.exe")

AgentTesla SMTP exfil server:
anemone.myhostpl.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.HEUR.QVM03.0.FD0F.Malware.Gen.2186.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c77984bc30ac4a91062acee8ad0106c5069b9cf5747c84dae5c1e5aaa87a509/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 12:48:07 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lr3zqs6dblcksedcvtxivuaqnrigtoopk5d4qtnolqpfvkuhuueq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5c77984bc30ac4a91062acee8ad0106c5069b9cf5747c84dae5c1e5aaa87a509

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5c77984bc30ac4a91062acee8ad0106c5069b9cf5747c84dae5c1e5aaa87a509

(this sample)

AgentTesla

Executable exe c13182433185c2298a137cbe333a037521b67c4e4ee6226c426c69df8e06f22b

  
Dropping
MD5 6d480c218f561e12fd63520fbd189135
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c13182433185c2298a137cbe333a037521b67c4e4ee6226c426c69df8e06f22b

Comments