MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87df62ffe5d654290681c9395606e0f15064b27ff0d810378de82f18134f81d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87df62ffe5d654290681c9395606e0f15064b27ff0d810378de82f18134f81d6
SHA3-384 hash: fded5df8af1854e3fca1e8ca0a96239980892e11e657b99a8c29640b7728a9fa3034b18ff28b553deee8d58cd18113b5
SHA1 hash: 9bf807ec53ccdcf28a2e281d6a4f6f33c5e0f82e
MD5 hash: ea6f0b2186b50479fe156b3edd46e7d8
humanhash: minnesota-early-winner-happy
File name:Past Due Invoice.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:440'173 bytes
First seen:2020-08-15 09:59:06 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:uFamHAucKYNX9D4g2wtPJv9CCX6WBPc8A:ukmHEKc/v9CCVPq
TLSH EB94239C384FB790961DA2D4963E2D1F5A50BB18526002C691F7B93236CE4A4DC2EDEF
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.bengiamein.gq
Sending IP: 5.8.93.20
From: Vickie Ingrassellino <admin@bengiamein.gq>
Subject: Past Due Invoice Unpaid
Attachment: Past Due Invoice.rar (contains "Past Due Invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27502.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87df62ffe5d654290681c9395606e0f15064b27ff0d810378de82f18134f81d6/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-15 10:01:05 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q7pwf77f2zkcsbubze4vmbxa6figjmt76dmban4n5axrqe2pqhla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/87df62ffe5d654290681c9395606e0f15064b27ff0d810378de82f18134f81d6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 87df62ffe5d654290681c9395606e0f15064b27ff0d810378de82f18134f81d6

(this sample)

AgentTesla

Executable exe f3635e26f70dfb1240a5f8c7b09ea634ee9e5b6692cb73829b0124c0b2505281

  
Dropping
MD5 a00d5eed9c1137d9413b3940ff655569
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f3635e26f70dfb1240a5f8c7b09ea634ee9e5b6692cb73829b0124c0b2505281

Comments