MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a74a2dc217026f23ea7f3c153d41994160abfb05520e50aa95a626eb24ae8836. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a74a2dc217026f23ea7f3c153d41994160abfb05520e50aa95a626eb24ae8836
SHA3-384 hash: 7e575c18c49aefc261d598e3154e36e3cdf42aeeef32096a49f7efcf16b4bdb975dd4869bec9872bb7185a917652855d
SHA1 hash: f85da2a97477f4ad59769333d42a0f3df52d526a
MD5 hash: 21189d51ea528ac4e63dbc5875749a3a
humanhash: hawaii-blue-moon-skylark
File name:39a0e9cb.jpeg, QUOTE2020.PDF.gz (3).zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:504'419 bytes
First seen:2020-12-10 09:02:47 UTC
Last seen:2020-12-11 07:40:39 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:LG2HMAy+cdQ0Rg9O2F68aYQThBbh3nNJlEk7OaN:LG2Ry+4Q0Rg9OcBQzh3nTOkCU
TLSH C4B423A6414E61DDD9AD6BB083E5A267F2C2211E2D732CFC1BC5D7C4560EE01E0F61AA
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""Lisa Reitschuster"<sales@dmgmori.co.jp>" (likely spoofed)
Received: "from dmgmori.co.jp (unknown [103.145.252.171]) "
Date: "10 Dec 2020 01:02:21 -0800"
Subject: "RE:URGENT SUPPLY QUOTE2020 16 Dec 2020 09:29:29 +0100"
Attachment: "39a0e9cb.jpeg, QUOTE2020.PDF.gz (3).zip"

Intelligence

File Origin
# of uploads :
5
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.18209.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a74a2dc217026f23ea7f3c153d41994160abfb05520e50aa95a626eb24ae8836/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-12-10 09:03:05 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
13 of 26 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u5fc3qqxajxsh2t7hqkt2qmzifqkx6yfkihfbkuvuytowjfora3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a74a2dc217026f23ea7f3c153d41994160abfb05520e50aa95a626eb24ae8836

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a74a2dc217026f23ea7f3c153d41994160abfb05520e50aa95a626eb24ae8836

(this sample)

AgentTesla

Executable exe 39abc161bea9d6cf4334eab2631bce686feeaa84ff68bfe4cd05e16f4548f06f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 39abc161bea9d6cf4334eab2631bce686feeaa84ff68bfe4cd05e16f4548f06f

Comments