MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 704b257ab6d3450715455c85d9de47b7e26a35036b00877e34421a41b3cdfa57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 704b257ab6d3450715455c85d9de47b7e26a35036b00877e34421a41b3cdfa57
SHA3-384 hash: cf619b350e452953ab97fc7a3efd19b5e816010b03231bc9afb18067156de41f940d8f2d67a4d2dd33987b7b70c824cb
SHA1 hash: fce0031a5136df3570b42ba9ee174e02710e8d7a
MD5 hash: 0fcfb3e25eecdac8ba265528ad4ca225
humanhash: fifteen-low-connecticut-zebra
File name:Purchase Order 2021 - 00041.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:441'536 bytes
First seen:2021-03-30 05:49:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:/Dx9nhFFXSvtdPR39ZbTQM5Ymo+Om7KNU:rx9hTXG3D9zKNU
TLSH 239423BD8095BF8D934F6190D27991AE1CD2073BD091B1B9189AE375C9E32F8BB341C6
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Rahul I Atop Solution LLC<coordinator@acs-dxb.com>" (likely spoofed)
Received: "from acs-dxb.com (unknown [217.146.88.165]) "
Date: "30 Mar 2021 07:26:51 +0200"
Subject: "Quotation required-Urgently"
Attachment: "Purchase Order 2021 - 00041.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn45.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/704b257ab6d3450715455c85d9de47b7e26a35036b00877e34421a41b3cdfa57
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/704b257ab6d3450715455c85d9de47b7e26a35036b00877e34421a41b3cdfa57/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-30 05:49:08 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=obfsk6vw2ncqofkflsc5txshw7rgunidnmaio7ruiinedm6n7jlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Gamarue
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/704b257ab6d3450715455c85d9de47b7e26a35036b00877e34421a41b3cdfa57

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 704b257ab6d3450715455c85d9de47b7e26a35036b00877e34421a41b3cdfa57

(this sample)

AgentTesla

Executable exe 965504bff8dbe047149efa3e661d859d87b543774f5d0d25a19219dc9be40cc5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 965504bff8dbe047149efa3e661d859d87b543774f5d0d25a19219dc9be40cc5
  
Dropping
AgentTesla

Comments