MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68639d5075eb362a0936836b4a376fc20c79c27403bb0a216f7ef9a9fe82cc45. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68639d5075eb362a0936836b4a376fc20c79c27403bb0a216f7ef9a9fe82cc45
SHA3-384 hash: 133b0eeb411f6c407597a0ea253673674f41e0dbabcecc39291492f517a03dbe701ef4a652d7be7a07c898ec4ffd0853
SHA1 hash: b218d117bec2ec586ed81b4b12f30cd5c96a7303
MD5 hash: cdf5db7144bc238029980f116768b354
humanhash: fillet-april-friend-purple
File name:INQUIRY_MS1830 INV 080420.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'214'464 bytes
First seen:2020-08-05 06:30:29 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:GYEAKxbLiNEb0OPLod0RvLhoEiBE5nMMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMMMI:DzNtOPlRDhovWMMMMMMMMMMMuMMMMMM4
TLSH FD456B357E52C461C6590B32D693DE3447227D47B05EE25D20CE3AC7E5BBBEA028A393
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: yenen.com
Sending IP: 23.106.160.251
From: Javier Biguri Villoslada <sales@yenen.com>
Subject: New Inquiry: 146760-1 Supplier : [REDACTED_DOMAIN]
Attachment: INQUIRY_MS1830 INV 080420.IMG (contains "INQUIRY_MS1830 INV 080420.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68639d5075eb362a0936836b4a376fc20c79c27403bb0a216f7ef9a9fe82cc45/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 06:32:06 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nbrz2udv5m3cucjwqnvuun3pyightqtuao5quilpp342t7uczrcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/68639d5075eb362a0936836b4a376fc20c79c27403bb0a216f7ef9a9fe82cc45

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 68639d5075eb362a0936836b4a376fc20c79c27403bb0a216f7ef9a9fe82cc45

(this sample)

AgentTesla

Executable exe b8c83fec461fa3c0dbca9cc651e6b2a6667f62330baee43c1acb0a2422be3699

  
Dropping
MD5 1b3447adeaa99b033b07fac90a7cf6fb
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b8c83fec461fa3c0dbca9cc651e6b2a6667f62330baee43c1acb0a2422be3699

Comments