MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4ef9224b2088f526fd29e2aac43903ac53113e93a7bb84d2c53de27ff642e1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4ef9224b2088f526fd29e2aac43903ac53113e93a7bb84d2c53de27ff642e1e
SHA3-384 hash: 3166fdca82aef5f8ef2262d945f17822cb92f340187802df76c8bd1f13aaee2be86f69102750a6b5d6e96def462c26b6
SHA1 hash: 5ce19ddfbd65bfca845d9fe233d137e08dc264c4
MD5 hash: d8bb86c3811d7dc9999d119d36c506fd
humanhash: nevada-four-robert-crazy
File name:LIHUA Technology (HK) order form.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:750'977 bytes
First seen:2021-04-07 12:53:57 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 12288:ElERhF+Mu5HJpXrXL5hbhOTQP9YIcyk4lCNt0IKqYT7QA9CZ6qptmJrTM4as5S:EizqTXL5OsP2I7ll80IKqYT0t6ctkr/c
TLSH 31F43344A6B45A783A1D0D434AD7F6145A3B58ECF9F618CC4C0EACFC7052F53E8AB622
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.CYQ.genEldorado.28105.26782.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a4ef9224b2088f526fd29e2aac43903ac53113e93a7bb84d2c53de27ff642e1e/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 12:54:05 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=utxzejfsbchve36styvkyq4qhlctce7jhj53qtjmkppcp73efypa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.56
Link:
https://yomi.yoroi.company/submissions/a4ef9224b2088f526fd29e2aac43903ac53113e93a7bb84d2c53de27ff642e1e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z a4ef9224b2088f526fd29e2aac43903ac53113e93a7bb84d2c53de27ff642e1e

(this sample)

AgentTesla

Executable exe df5e40d1e917f0bd4c424f65c8e2557d094f5eff22b4ba6f63f093333ebbb8a9

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 df5e40d1e917f0bd4c424f65c8e2557d094f5eff22b4ba6f63f093333ebbb8a9
  
Dropping
MD5 31dc788638f4b572964fbf2c9ef39afc

Comments