MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89e2021ab6fa9ec200cf0944db86008d8fee7dd6ff60f2d040665f4bc6dd2a29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89e2021ab6fa9ec200cf0944db86008d8fee7dd6ff60f2d040665f4bc6dd2a29
SHA3-384 hash: 31731acca546f51855069a2f79b8f8c986295969b8376b79f2eafb218c9106b181359559e660e28eb99b822a9bfbf9bd
SHA1 hash: 2a91a1d28c3e275edb6c3f327607f8786ddfcf42
MD5 hash: 250f06ae1d8b19ad6059ab9dd54a7a6c
humanhash: india-gee-lemon-colorado
File name:Products_Pictures_logo_Designs_ pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:178'765 bytes
First seen:2020-10-13 07:54:53 UTC
Last seen:2020-10-13 07:56:39 UTC
File type: rar
MIME type:application/x-rar
ssdeep 3072:Hw1GtoIQGJ1SRg41CCHeMTG7ck90pjtelmH/cYzTSIXcL1/wekHuVe5Q+F:Hw17IQGfSRg4DeF7cjNYmH/cYqnzkOVe
TLSH FB042388E9832F2A0D7284D9D417C79474E6946B9E8B3FD01B096D843393F7F1D66CA8
Reporter abuse_ch
Tags:rar Yahoo


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: sonic305-22.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.185.148
From: benco incorporated <dougles_g_russell@yahoo.com>
Reply-To: bencoincorporated@yahoo.com
Subject: Fw: latest PI
Attachment: Products_Pictures_logo_Designs_ pdf.rar (contains "Pictures_logo jpeg jpeg jpeg.exe")

Intelligence

File Origin
# of uploads :
5
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/89e2021ab6fa9ec200cf0944db86008d8fee7dd6ff60f2d040665f4bc6dd2a29/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 06:18:23 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rhraegvw7kpmeagpbfcnxbqarwh647ow75qpfucamzpuxrw5fiuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/89e2021ab6fa9ec200cf0944db86008d8fee7dd6ff60f2d040665f4bc6dd2a29

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 89e2021ab6fa9ec200cf0944db86008d8fee7dd6ff60f2d040665f4bc6dd2a29

(this sample)

AgentTesla

Executable exe 6f0c4fde6a68ef453982bb4958cb5d571cf45179b2bc623fa4cc9a8f69f85823

  
Dropping
MD5 4b55159bed167b70cddbb20de7a0ae4e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6f0c4fde6a68ef453982bb4958cb5d571cf45179b2bc623fa4cc9a8f69f85823
  
Dropping
SHA256 13229c9c14567138633feaea0855b413eef1d17a5660932d9a7cdf961dadc55c
  
Dropping
MD5 f57f1ab73d4975429b105553bdc09b15
  
Dropping
SHA256 39a76f88dd2a2ebc1ef8a21c852813b486cb969d062a973610b60eeaef436e11
  
Dropping
MD5 4c420c50f66b416a244d38c8b255638a
  
Dropping
SHA256 3b186df707073ee060879549b75f11e1cad4c225d2dc4d0c3d290e9fd29517a8
  
Dropping
MD5 241f1e6a4084d8aa20b526001d5cf982
  
Dropping
SHA256 d55bd71d4425756d7412d97dd2e0c53203ba40fae381c980322aee5682acc79c
  
Dropping
MD5 7e747e7448b720d3d3b334c41863e66c

Comments