MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 706da3c895a77d9dc0832ea9e2eb875b3a299c67e2f90cbbd39b623462ba5bc3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 706da3c895a77d9dc0832ea9e2eb875b3a299c67e2f90cbbd39b623462ba5bc3
SHA3-384 hash: 3b55e288ee149f5b847339d100697b4fb99f60754ec74640b7b0b7c8468eb0f007bd18cf875155160c73be67aea39de9
SHA1 hash: 6dbd8aaaa3bd36c60aa96914d0dab64013264086
MD5 hash: 9a5ac81169d11975d1c0ae2f7721d636
humanhash: one-bakerloo-fillet-hot
File name:Payment-copy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:589'576 bytes
First seen:2020-07-21 15:35:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:D6VNFWKCwKE0SbDizs6XNfmK81KophvYY/a4U+V+fXqeVfQXr3SUFV/hf:eVNgKCdS3sfNuK81ThAyXhgfavXrCC
TLSH 55C4233A6B445BE01D871D781C1EF0D8C8A273635654B192729A708FAFB2A6CDDC7387
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mailserver.aerospeedgroup.com
Sending IP: 103.30.245.46
From: Accounts <winda@trimgairlines.com>
Subject: Payment confirmation
Attachment: Payment-copy.zip (contains "Payment-copy.exe")

AgentTesla SMTP exfil server:
mail.skysponder.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.a1e5bbacec08572d.7332.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/706da3c895a77d9dc0832ea9e2eb875b3a299c67e2f90cbbd39b623462ba5bc3/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 15:37:05 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=obw2hsevu56z3qedf2u6f24hlm5cthdh4l4qzo6ttnrdiyv2lpbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/706da3c895a77d9dc0832ea9e2eb875b3a299c67e2f90cbbd39b623462ba5bc3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 706da3c895a77d9dc0832ea9e2eb875b3a299c67e2f90cbbd39b623462ba5bc3

(this sample)

AgentTesla

Executable exe 8501c67f38ab4539d326cf388311519c918d179da7a5b4228af51767d652f4ac

  
Dropping
MD5 a1e5bbacec08572d189c3ab68ead5d1b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8501c67f38ab4539d326cf388311519c918d179da7a5b4228af51767d652f4ac

Comments