MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aeaa793651beacad10e735be37ed34a7b6274cacc8dec9c239872473de200343. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aeaa793651beacad10e735be37ed34a7b6274cacc8dec9c239872473de200343
SHA3-384 hash: e7dc18af7e3e5e7d3f033a5fbcc95d11f7b5fb8b26db4b7f523bd7c1d80fd36d1324f9f34e713dd464fa98878fcd7ce7
SHA1 hash: cc6d90e13d2882875378efc7ccee2afe383884f2
MD5 hash: e39aad348f3ce0bee74105d16a357afa
humanhash: orange-double-juliet-grey
File name:Items.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:289'956 bytes
First seen:2021-03-04 07:11:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:J2aun2z89LNm+yP4IhKUUFyx2h0F6cB71i5F1zHdiAuJT9b708ceD98vQLcxw7Xm:UasXFNmr40Ukx2eFThQ9iF9b70wqvQLE
TLSH A2542335D9F7666B68FB83F487548FAB5F6E09ED388E8380B50052035278A1C39C61BD
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Hania Ghalayini <prnagar@parixit.com>" (likely spoofed)
Received: "from parixit.com (unknown [64.52.174.242]) "
Date: "3 Mar 2021 15:14:40 -0800"
Subject: "QUOTE FOR PRQ-30223 RSTMI7-2520"
Attachment: "Items.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aeaa793651beacad10e735be37ed34a7b6274cacc8dec9c239872473de200343/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 17:10:00 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v2vhsnsrx2wk2ehhgw7dp3juu63cotfmzdpmtqrzq4shhxraanbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/aeaa793651beacad10e735be37ed34a7b6274cacc8dec9c239872473de200343

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip aeaa793651beacad10e735be37ed34a7b6274cacc8dec9c239872473de200343

(this sample)

AgentTesla

Executable exe 938a1c15eab21846b96971f70eac4ef78f273adf89d6305aee7b91f5212e9013

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 938a1c15eab21846b96971f70eac4ef78f273adf89d6305aee7b91f5212e9013
  
Dropping
AgentTesla

Comments