MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 612e53f0e6a50c86e316bdc0600ddb89f7e5b51a26c879248adcc59c65524ef9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 612e53f0e6a50c86e316bdc0600ddb89f7e5b51a26c879248adcc59c65524ef9
SHA3-384 hash: 70b49a49010db744ceacede7b734c07c00ed2813e19e27c0f2b7f0a5450f8be94c9a96bc2b8006c60e3c72dc37a3662a
SHA1 hash: 9cb3de373cd75bde5e55c111a79eee662b7938f2
MD5 hash: ddd5b29a63ccca6f031d825f09f3bec8
humanhash: charlie-quiet-autumn-mobile
File name:APRILQUOTATIONQQO2103060_SAMPLES_KHANGHY_CO_CORPORATION.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:545'128 bytes
First seen:2021-04-07 05:54:04 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:zqG8U+mb/VToyRW+MfvVc+f45dpV5X7UrGnb39DbU/wu:zKc/9o7v1gprX7HL9kwu
TLSH 31C423D2252192123669137AB4F78D31A8371E9ED2CDF1121588170D4FDA88AFE6F27F
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ns89104.dotvndns.vn
Sending IP: 112.213.89.104
From: Nguyen Thi Kim Ngan <sales.ngannguyen@khanghy.com.vn>
Subject: NEW APRIL QUOTATION
Attachment: APRILQUOTATIONQQO2103060_SAMPLES_KHANG HY_CO_CORPORATION.arj (contains "APRILQUOTATION#QQO2103060_SAMPLES_KHANG HY_CO_CORPORATION.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.30073.26818.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/612e53f0e6a50c86e316bdc0600ddb89f7e5b51a26c879248adcc59c65524ef9/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 01:08:12 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mexfh4hguuginyywxxagado3rh36lni2e3ehsjek3tczyzksj34q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/612e53f0e6a50c86e316bdc0600ddb89f7e5b51a26c879248adcc59c65524ef9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 612e53f0e6a50c86e316bdc0600ddb89f7e5b51a26c879248adcc59c65524ef9

(this sample)

AgentTesla

Executable exe 4fa158cc0fa6577b7744c71375daa38ff6ce0818b9cfc82899f7e6e46a8601d4

  
Dropping
MD5 e2bceeb0f0aed47adb230cf01044f588
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4fa158cc0fa6577b7744c71375daa38ff6ce0818b9cfc82899f7e6e46a8601d4

Comments