MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b008571a5c3ccd2f3b90fde0d391dc4360633e2c2b6cae6b483df3bc2c2533fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b008571a5c3ccd2f3b90fde0d391dc4360633e2c2b6cae6b483df3bc2c2533fe
SHA3-384 hash: 4606ad878f79467c6ed8c69d0909ee7b0a0b636f2231a7d6354d350add35913d5beac861207688dcdc6cec6324b960c4
SHA1 hash: 824d32d4ccc7c63244606e9f602949c824de5851
MD5 hash: c40fc3605239c1b8bdad946b6486c286
humanhash: lemon-johnny-moon-zebra
File name:Payment Slip.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:870'142 bytes
First seen:2020-08-28 06:28:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:8yPIn4tX1Ea5alpK7s8IaEie7lCEx0Uve:8ae4tX1EEaHK7svlUEJm
TLSH 26053321F6A0EA7FFEA04BF90146770D057036527419634FD8CA9A375C72A7CBAB019E
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hanrm.com
Sending IP: 192.3.9.190
From: stella@hanrm.com
Reply-To: stella@hanrm.com
Subject: 确认 (Payment slip)
Attachment: Payment Slip.zip (contains "Payment Slip.exe")

AgentTesla SMTP exfil server:
smtp.millndustries.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21785.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b008571a5c3ccd2f3b90fde0d391dc4360633e2c2b6cae6b483df3bc2c2533fe/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 04:50:45 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=waefogs4htgs6o4q7xqnheo4inqggprmfnwk422ihxz3ylbfgp7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b008571a5c3ccd2f3b90fde0d391dc4360633e2c2b6cae6b483df3bc2c2533fe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b008571a5c3ccd2f3b90fde0d391dc4360633e2c2b6cae6b483df3bc2c2533fe

(this sample)

AgentTesla

Executable exe 4c61b7e22d734c70904acd8b8c64f5e40aa837729bbcec8d50f11addfb652963

  
Dropping
MD5 633f0c1408bad862b183c78a4c3d57f4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4c61b7e22d734c70904acd8b8c64f5e40aa837729bbcec8d50f11addfb652963

Comments