MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 694f4283317011f1147540d5c023702c9ce80c00074b840b147a0e802307ef43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 694f4283317011f1147540d5c023702c9ce80c00074b840b147a0e802307ef43
SHA3-384 hash: 7aa4d15d735b6462c875508a4d68a513b4e07bcc153c7b006e1b3d8706cea97e118f0357f3f69a8f24dd2e1df650a9d7
SHA1 hash: 92bef9b39effae5b3f0ed152104fd8dc9cc07417
MD5 hash: 05f65dc36311883a6aeb12529a613903
humanhash: fish-football-robin-item
File name:RFQ9292223.pdf.gz.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:417'047 bytes
First seen:2020-08-18 12:28:08 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:UJksyXrBWJ+rtTgGHGwyGEdIzSe5MB9UABvB0kTB:GOXrBWJ+rdguGwy7d2MUcvOkTB
TLSH DF94239C0F08E263E91FBD11A4C7911FA9E1D9B0E32615D3EA1FAF937724A54624708F
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: icplpk@cyber.net.pk
Subject: RFQ: Order - Mediform S.A
Attachment: RFQ9292223.pdf.gz.rar (contains "vtRjIGDr44SeCsj.exe")

AgentTesla SMTP exfil server:
smtp.fretian-muc.de:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/694f4283317011f1147540d5c023702c9ce80c00074b840b147a0e802307ef43/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 12:30:06 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nfhufazroai7cfdvidk4ai3qfsooqdaaa5fyicyupihiaiyh55bq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/694f4283317011f1147540d5c023702c9ce80c00074b840b147a0e802307ef43

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 694f4283317011f1147540d5c023702c9ce80c00074b840b147a0e802307ef43

(this sample)

AgentTesla

Executable exe 263573ece93d13d69ed99ea6be5715ca5b15e1877ed09a274ca9cf55f4d16a22

  
Dropping
MD5 34a2a16af9fcebce83eaea48ae2381a1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 263573ece93d13d69ed99ea6be5715ca5b15e1877ed09a274ca9cf55f4d16a22

Comments