MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ed5f5500ce50d72848daf1cc7091d340ef5497f2d45bffd86f48d91d4f90bb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ed5f5500ce50d72848daf1cc7091d340ef5497f2d45bffd86f48d91d4f90bb2
SHA3-384 hash: caad811e60b524f3d16bf25415d8b6cd093b2cc60873be7a8d5bd458ee392f7b2ef9e21d3d25acb513ea5d6477f0d8d5
SHA1 hash: 374310aa935ffbaba9a26121cb74fa457125a6f4
MD5 hash: d4175e7e6880d7a87508df66232bd0af
humanhash: item-high-uniform-wyoming
File name:PO16388.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:774'221 bytes
First seen:2021-01-15 07:20:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:60x7jiaTq7xBT1VWBLtPfTumxoBR7Lnl404Khy6bvQHF34rD9C2qolKxxEY/bg9x:609FTw14RPLuCuRHlJ4Khy6r0lVuE/sD
TLSH B8F423B6B73F81C9C7C5CEFA98B9928B136E0F3A6D2D75279D13DB20B11109D011AA35
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: localserver.localdomain
Sending IP: 49.239.156.11
From: Michelle Liu<michelle.liu@me.net>
Subject: Re: Purchase Order Request
Attachment: PO16388.zip (contains "PO16388.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1137.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Siggen11.57608.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ed5f5500ce50d72848daf1cc7091d340ef5497f2d45bffd86f48d91d4f90bb2/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-15 07:21:25 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r3k7kuam4ugxfbenv4omoci5gqhpksl7fvc377mg6sgzdvhzboza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8ed5f5500ce50d72848daf1cc7091d340ef5497f2d45bffd86f48d91d4f90bb2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 8ed5f5500ce50d72848daf1cc7091d340ef5497f2d45bffd86f48d91d4f90bb2

(this sample)

AgentTesla

Executable exe f473ac0704e2a9083c308f5f016f05682e69ba1a201b493d65a5a7bb09538405

  
Dropping
MD5 25a484b616908f764422feafbbc401d9
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f473ac0704e2a9083c308f5f016f05682e69ba1a201b493d65a5a7bb09538405

Comments