MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86bf67ae096a12f9c7d1d38c03d8f2c5c3e165005253bb63bf3afbea83de8a92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86bf67ae096a12f9c7d1d38c03d8f2c5c3e165005253bb63bf3afbea83de8a92
SHA3-384 hash: 7171c3b14657d45ca88c68b70f52dd93f1f9f1305871cc8e27ddc0fa864252105171c6502bcc6c661e126314ae02c082
SHA1 hash: 202af1b792f6234cc739a8213f728d5350a00525
MD5 hash: d88e9a728da9f2f284ba409a82023fd2
humanhash: leopard-orange-north-speaker
File name:IMG-74565456789876789876545678-2345987.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-18 08:48:03 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:W+b5Gcfr1qPb4DwqLukbRrmDffvrMaP0fFBlf4O:5b5GBi9bxmD3vJ6F
TLSH 6245D0B9F680CAE6C06647327216DF7411377E392F75B10B3B483AA73E7289A8415F85
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ct13632.vservers.es
Sending IP: 188.164.194.49
From: cuentas <cuentas@frutasyverdurasbernimabel.com>
Subject: Re: Confirmación de aviso de pago
Attachment: IMG-74565456789876789876545678-2345987.IMG (contains "IMG-74565456789876789876545678-2345987.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86bf67ae096a12f9c7d1d38c03d8f2c5c3e165005253bb63bf3afbea83de8a92/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 08:49:04 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q27wplqjnijptr6r2ogahwhsyxb6cziakjj3wy57hl56va66rkja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 86bf67ae096a12f9c7d1d38c03d8f2c5c3e165005253bb63bf3afbea83de8a92

(this sample)

AgentTesla

Executable exe 50d83791145d6b09c47fc90279d568bff571181c97d9dad9ab63c3e9c9b935af

  
Dropping
MD5 1a805b9b1977259445dbfb5006b4b730
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 50d83791145d6b09c47fc90279d568bff571181c97d9dad9ab63c3e9c9b935af

Comments