MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7bf79c6a0f05a81454642c6bf7ef69fea9324426959e327f96d81d20acd5e5ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7bf79c6a0f05a81454642c6bf7ef69fea9324426959e327f96d81d20acd5e5ab
SHA3-384 hash: ea505b7b5a715e1905d68cecf1d65e3adc262e4a9ca0efcd9a384a0edf070d22978165b63872fc75f43265354b457ea5
SHA1 hash: e0f6bb9aa86f876c68e66852ccf25f9fb1e7bb1a
MD5 hash: 9567594ef048f211ac4855c18d4661db
humanhash: social-wisconsin-salami-fillet
File name:Payment Proof.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:374'826 bytes
First seen:2020-11-18 12:30:10 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:XX0Kefv5YQnqdFAbQHZnF2LBopDrzFZa7IUxqrAp4DJL3qvk9GC1jswTe/2p2VnE:XXv8mYqd2QHr2LBop7iVc+4NLBT1jsd2
TLSH 8A8423E0362187379D688A00172FCF3569F6E17A60E3246F4775E62FC76D82B1934DA8
Reporter abuse_ch
Tags:AgentTesla gz Telegram


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.bgonair.bg
Sending IP: 78.142.63.116
From: pradeva@bulgariaonair.bg
Subject: Fw: Proof of Payment
Attachment: Payment Proof.gz (contains "Payment Proof.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7bf79c6a0f05a81454642c6bf7ef69fea9324426959e327f96d81d20acd5e5ab/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 12:31:04 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pp3zy2qpawubivdefrv7p33j72uterbgswpde74w3aosblgv4wvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 7bf79c6a0f05a81454642c6bf7ef69fea9324426959e327f96d81d20acd5e5ab

(this sample)

AgentTesla

Executable exe 53199d2d6d3d21f6a1549eb84faa73b98e68c3c0c4ca31889852a10277125e3a

  
Dropping
MD5 be0a70281a47d24b56cbe37ced8a8bd5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 53199d2d6d3d21f6a1549eb84faa73b98e68c3c0c4ca31889852a10277125e3a

Comments