MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9756c3a6a94089500e36dc605d50a4365c656274c78f0d0416a3d331510f5ab8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9756c3a6a94089500e36dc605d50a4365c656274c78f0d0416a3d331510f5ab8
SHA3-384 hash: f4060f822452502b4eb29b6baca6c1558b7fe3c291eddf490f24decd919ea81cf7c2ce9bd8667f7df9b940680e00287f
SHA1 hash: 2987843ee0f0059742f7232cc2fe13c1a5679a65
MD5 hash: a0d9a3ae7fb3a99edb55897f7f194bed
humanhash: mountain-bulldog-jupiter-venus
File name:Purchase Order - PO -SLD GRT-07480.pdf.001
Download: download sample
Signature AgentTesla
Create hunting rule
File size:426'543 bytes
First seen:2020-06-22 18:56:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:KlLl3xwoFE+3ZnsxhhKyhL9AUUrq1lfOC6j67TyV7TrkcO9qA3myBgJcm1Mi:KlZyh+JnwhLpNyfVnwv2IY1r
TLSH F1942311FE0E765E9F395D7DBB2621262244C27F1D88FE91402F52BC2E28643429F5FA
Reporter abuse_ch
Tags:001 AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: Anthony Barbachan <abarbachan@isaindustrial.com>
Subject: Purchase Order - PO #07480
Attachment: Purchase Order - PO -SLD GRT-07480.pdf.001 (contains "Purchase Order - PO -SLD GRT-07480.pdf.exe")

AgentTesla SMTP exfil server:
mail.flsrnidth.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9756c3a6a94089500e36dc605d50a4365c656274c78f0d0416a3d331510f5ab8/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-22 12:55:59 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s5lmhjvjicevadrw3rqf2ufegzogkytuy6hq2bawupjtcuiplk4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 9756c3a6a94089500e36dc605d50a4365c656274c78f0d0416a3d331510f5ab8

(this sample)

AgentTesla

Executable exe d757bb9a190984035e621c9be0d393a9ba6de60bca0256ad7268e68eea276cdc

  
Dropping
MD5 622edc1b39bf1ed986b68ab25bdbfe5a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d757bb9a190984035e621c9be0d393a9ba6de60bca0256ad7268e68eea276cdc

Comments