MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b50a0633963a8ae9cfd05db3af16c16584c55d707a5dac3633cb5318fca4b6d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b50a0633963a8ae9cfd05db3af16c16584c55d707a5dac3633cb5318fca4b6d2
SHA3-384 hash: f42fe7ae717e4fb8dcb241da57c5363a873d7f8a73c86c5ff3d75cc88ed52acfcc9c4e0933d67d717e93313dc735891e
SHA1 hash: a225961801d1fc19ca04249f1aaad244e217532d
MD5 hash: dfcf3dc44676f51e3ebc126cdb7f5e12
humanhash: finch-vermont-speaker-mobile
File name:proforma invoice.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:377'005 bytes
First seen:2020-06-08 04:54:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:XN7KSt9fM5zqMn8pX14YqNO8xZcMP4BnoCf3bKMhxwbKNKXAijI6JAGK9SXeA:XN7Xt9f4qM8rb8DHPxCf3/PGKNKQcI6f
TLSH 9D842334D377CB782B740B0B762CA6E7A66076BD78A1580D5618E04E49B8B712F18E9C
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sg2nlshrout01.shr.prod.sin2.secureserver.net
Sending IP: 182.50.132.193
From: accounts@zeketrolleys.com
Subject: Re: profoma
Attachment: proforma invoice.zip (contains "proforma invoice.exe")

AgentTesla SMTP exfil server:
business41.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23890.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 04:56:05 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wufamm4whkfott6qlwz26fwbmwcmkxlqpjo2ynrtznjrr7few3ja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b50a0633963a8ae9cfd05db3af16c16584c55d707a5dac3633cb5318fca4b6d2

(this sample)

AgentTesla

Executable exe c9b3d6a92282d003ae960076c147e224c8064fd98229c96df353948dc685237b

  
Dropping
MD5 b79c749616e332aa98dff35091bc7ddb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c9b3d6a92282d003ae960076c147e224c8064fd98229c96df353948dc685237b

Comments