MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 666c965436669b81b5b36f6489ab29fcd91297cc0d131e55e906251537fa9533. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 666c965436669b81b5b36f6489ab29fcd91297cc0d131e55e906251537fa9533
SHA3-384 hash: fa73f62f4865ac1c33a69d0d7c730103ed172d40cfabb598bca78de4012a063e00b1c8cc6bb0180fae3632fbfa0e2fdb
SHA1 hash: 4fa8f70ed35bda5a40d419e4144a6041289d8dac
MD5 hash: 42a4a8d3ca9c025eababc30774afbe3e
humanhash: mango-wyoming-sierra-purple
File name:INVOICE.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:336'397 bytes
First seen:2020-07-02 07:51:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:WgFEX0pLvMt7D+0TKlwUgM4hAwm2lGLbaub4UILxK1:WgFjLEs0iMlG3aub4u1
TLSH 4464239D56EC0F113FDAB2910080C121EEE5A623EA935177A854ECAF9D12FF216B3907
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: jch.jchllantas.com.pe
Sending IP: 162.214.71.14
From: ventas.piura@evocars.pe
Subject: proforma invoice
Attachment: INVOICE.zip (contains "INVOICE.exe")

AgentTesla SMTP exfil server:
smtp.ionos.es:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22125.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/666c965436669b81b5b36f6489ab29fcd91297cc0d131e55e906251537fa9533/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 07:53:05 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mzwjmvbwm2nydnntn5sitkzj7tmrff6mbujr4vpjaysrkn72suzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 666c965436669b81b5b36f6489ab29fcd91297cc0d131e55e906251537fa9533

(this sample)

AgentTesla

Executable exe ddf0e82231f5acc5e5e024555cf900b3f374cfbc55be09e3c0fb430deb59ea79

  
Dropping
MD5 7d1b04f3a1b7a6f5ff58c5a1cf9bc698
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ddf0e82231f5acc5e5e024555cf900b3f374cfbc55be09e3c0fb430deb59ea79

Comments