MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4fcaa7db9e6bf01523e00bb55061e1e984c09a116935e0190cb008ae07e18f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4fcaa7db9e6bf01523e00bb55061e1e984c09a116935e0190cb008ae07e18f5
SHA3-384 hash: 4112335a280005c390a822d8cce0636fd26c207df774e83ecbe93f81af1f73a7d08ff5fd21a3a19c39a7d5a0b7465416
SHA1 hash: de9913c3a23742514e09a8ef93ea8fd962c9bf09
MD5 hash: 260c71f3b5c92f9d7933b94541441fd2
humanhash: jupiter-mars-oranges-ohio
File name:remittance copy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:673'345 bytes
First seen:2020-10-21 05:02:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:CLq64vR8QAu8P2aD7pJ6jojHuZG/L93vnO/YY7b5nbRIM80Hn3uEFt7:CLq607Az2aDNJ6aHKaVP2YSn980HfFR
TLSH 7DE423BE2057C05567746DF4726BF736161BC61BAA042AFB614CAFFB1A64A040F2C12F
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "agencqhd <agencqhd@hoscogroup.com>"
Received: "from de05.enroot.cloud (de05.enroot.cloud [89.22.105.49]) "
Date: "Tue, 20 Oct 2020 16:26:33 +0100"
Subject: "RE:PAYMENT ADVISE(103) TT/USD/81457/2"
Attachment: "remittance copy.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.3678.8064.4999.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a4fcaa7db9e6bf01523e00bb55061e1e984c09a116935e0190cb008ae07e18f5/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 16:15:00 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ut6ku7nz427qcur6ac5vkbq6d2meycnbc2jv4amqzmaivyd6dd2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a4fcaa7db9e6bf01523e00bb55061e1e984c09a116935e0190cb008ae07e18f5

(this sample)

AgentTesla

Executable exe e69f4c47b18fd9ffa5a35b69cb0e7fd57967fa542334b6a48b449ae123030646

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e69f4c47b18fd9ffa5a35b69cb0e7fd57967fa542334b6a48b449ae123030646
  
Dropping
AgentTesla

Comments