MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9be262d5a006d3f9a519899e94a6c3ff4d2a0c1ca8e3eaef6cc290f607621653. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9be262d5a006d3f9a519899e94a6c3ff4d2a0c1ca8e3eaef6cc290f607621653
SHA3-384 hash: 0d2890a0aab3d2d490f63ccce6356494e746a5beed5eb3f4e9cf3887d256dbf08e68e6fbb081e1c72677ab1370fe1006
SHA1 hash: 2b165efbd54e04450f28dd2d701db421448554cc
MD5 hash: efa640a49cfa5fe1e79786894cd3d275
humanhash: fanta-orange-echo-uranus
File name:Payment Copy.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:423'235 bytes
First seen:2020-06-17 05:43:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:btP/W0jWKCDnxhm5P2SPRCTTAVjOOqysU:bZ2KQnTc5CT45Jv
TLSH C69423D8970E3E2EA6B7250F9C5F1F2B63B210A1555382B7A5530DE3A2CC19C53E9B90
Reporter abuse_ch
Tags:AgentTesla HSBC z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sc.com
Sending IP: 95.211.208.50
From: HSBC Global Payments and Cash Management <fbaraza@sc.com>
Subject: FW: Global Payments and Cash Management HSBC
Attachment: Payment Copy.pdf.z (contains "Payment Copy.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21237.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 05:45:05 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tprgfvnaa3j7tjizrgpjjjwd75gsuda4vdr6v33mykipmb3cczjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9be262d5a006d3f9a519899e94a6c3ff4d2a0c1ca8e3eaef6cc290f607621653

(this sample)

AgentTesla

Executable exe 228f19c1186ef3077b4d7bd5ca03253f4a769ce6af984e1c4b0d40bc46948f7d

  
Dropping
MD5 d73394d96ee081d9cabe7bf8cb1bdc53
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 228f19c1186ef3077b4d7bd5ca03253f4a769ce6af984e1c4b0d40bc46948f7d

Comments