MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88b48dca63b6fbe026938531c14585c3e53d3ecf718d43d4666fde4d2646fbe1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88b48dca63b6fbe026938531c14585c3e53d3ecf718d43d4666fde4d2646fbe1
SHA3-384 hash: 944b56dd7af99b353666e4995a65336f4944017e40eefb4ec14ea90a911ef0d86841f732f45188b3d9ff7a5dfd28e8fb
SHA1 hash: 03ce672bafe1dab2a53eba4ff9c94ea69e6919ed
MD5 hash: d9f782837743d0c5219d9b176efa6cb8
humanhash: quebec-seventeen-fanta-timing
File name:Vacuum Sampler e-Vac.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:264'950 bytes
First seen:2020-06-09 08:32:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:r/H9yhZfkEymYR4Fo0QFJlCmkbKw8jGtxyclmR3qvAe:rvEMJR4FzOJfkbR8jelosV
TLSH 2A4423A4D5F1295671C7282FA997A80F3732BC98D468088331E1D0993A7AD35F3F752E
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: harbro.co.uk
Sending IP: 192.119.106.147
From: Karen Cheyne <Karen.Cheyne@harbro.co.uk>
Reply-To: Karen.Cheyne@harbro.co.uk
Subject: Vacuum Sampler e-Vac
Attachment: Vacuum Sampler e-Vac.zip (contains "Vacuum Sampler e-Vac.exe")

AgentTesla SMTP exfil server:
mail.adithyaeng.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.896820.30237.10481.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 08:34:04 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rc2i3stdw356ajutquy4crmfypst2pwpogguhvdgn7pe2jsg7pqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 88b48dca63b6fbe026938531c14585c3e53d3ecf718d43d4666fde4d2646fbe1

(this sample)

AgentTesla

Executable exe 149be5aa7ad683b6f79a2d7455334effbc37078baa81104b83736c6b93212666

  
Dropping
MD5 ab951887459da5b8cfc657f57c0c40a3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 149be5aa7ad683b6f79a2d7455334effbc37078baa81104b83736c6b93212666

Comments