MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8002b3ff17186600fc8f26d89eab8fc582dc7a482924d1fc46cd3a3e1991ce76. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8002b3ff17186600fc8f26d89eab8fc582dc7a482924d1fc46cd3a3e1991ce76
SHA3-384 hash: 2cee40525567296ac2846cdcc0cf8420471bb817e1e5b90263ca677aaa024ca04f1d2fbefd0ec2fd8f438e6be7792e75
SHA1 hash: f74db85b9ea219c229318fbe7955035229318cb6
MD5 hash: 20c5126dcb35f06a78f3f7bc43350432
humanhash: oregon-west-four-salami
File name:PO 000941.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:435'078 bytes
First seen:2021-01-05 09:37:51 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:lC/YrZY3XbZLiYXULA3DI5ZYSO3CzjWKpsboZDgQ3R:sQqHbZhIwS3bpUOJR
TLSH B494232EB5B5152B600AAA2886BF54B46197C21C49CE6358FCFACE3C3DF15B49B4C847
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns2.extraweb.az
Sending IP: 94.20.21.50
From: Jack Wang <purchase@shradhaaengg.com>
Reply-To: jack.wang <jack.wang.maxmothes.cn@outlook.com>
Subject: Re: Order Confirmation / Quotation.
Attachment: PO 000941.rar (contains "PO #000941.exe")

AgentTesla SMTP exfil server:
smtp.breezetravelling.com:587

AgentTesla SMTP exfil email address:
info@breezetravelling.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8002b3ff17186600fc8f26d89eab8fc582dc7a482924d1fc46cd3a3e1991ce76/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-05 09:38:06 UTC
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qablh7yxdbtab7epe3mj5k4pywbny6sifesnd7cgzu5d4gmrzz3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8002b3ff17186600fc8f26d89eab8fc582dc7a482924d1fc46cd3a3e1991ce76

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 8002b3ff17186600fc8f26d89eab8fc582dc7a482924d1fc46cd3a3e1991ce76

(this sample)

AgentTesla

Executable exe cbf9d4ef21092210f58ad0cbdd4753dbbf785387dd8f3001014672679196c65c

  
Dropping
MD5 1bb7bfa8b8b5280a8a1261f22241bb03
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cbf9d4ef21092210f58ad0cbdd4753dbbf785387dd8f3001014672679196c65c

Comments