MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ed08b5cb8da0b4d89c613a65fa914e08db5cedd9cf6f4c87a6e6671a7d79574. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ed08b5cb8da0b4d89c613a65fa914e08db5cedd9cf6f4c87a6e6671a7d79574
SHA3-384 hash: 3678d994c37ea16c600e1e24209c6a894385e23545a836ef96deac6bba094cf84fd2adf37aca863f772e49f8cdd9eac4
SHA1 hash: 8c63a8fb08ff447e62ba78a3eacd9025771997ed
MD5 hash: 2dadc0e690673fd187988248fe094e6e
humanhash: rugby-wisconsin-louisiana-montana
File name:Purchase Orders -Foreign_0000000000000058876.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:423'924 bytes
First seen:2021-03-03 07:39:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Vmlm6l1xg5yoIHC9piWzAxX4Lt3JXvP975OAoRiOXbm++SVvz1sYByyHCYBCm57L:Vw916niIpbAJKBuAovbp34uCYnP
TLSH 8A9423C2B2040521AE0767F0D57E9AF517A3C712A31AEF73BA77127D2184A7799B4CE0
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: slot0.muemack.com
Sending IP: 194.31.96.90
From: HARTON Anlagentechnik GmbH <postmaster@muemack.com>
Subject: Fw: AW: Purchase Orders - Foreign_000000000058876
Attachment: Purchase Orders - Foreign_0000000000000058876.pdf.zip (contains "Purchase Orders - Foreign_0000000000000058876.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9ed08b5cb8da0b4d89c613a65fa914e08db5cedd9cf6f4c87a6e6671a7d79574/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 07:40:26 UTC
AV detection:
18 of 47 (38.30%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t3iiwxfy3ifu3cogcotf7kiu4cg3ltw5tt3pjsd2nzthdj6xsv2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9ed08b5cb8da0b4d89c613a65fa914e08db5cedd9cf6f4c87a6e6671a7d79574

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9ed08b5cb8da0b4d89c613a65fa914e08db5cedd9cf6f4c87a6e6671a7d79574

(this sample)

AgentTesla

Executable exe 3c38f11bd2a09edb1a0deebe122f51d632d3bed70242e2fb5dca1de10743e45a

  
Dropping
MD5 7c2780f44e3de7bf2a0515495a053f0d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3c38f11bd2a09edb1a0deebe122f51d632d3bed70242e2fb5dca1de10743e45a

Comments