MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5515d79ca4186d8e22a6e41b5ce5f930b0082b745d07a5228a735c197d5afdf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5515d79ca4186d8e22a6e41b5ce5f930b0082b745d07a5228a735c197d5afdf
SHA3-384 hash: 4c0370804ec126db5d0f00be0ce4195f3a2d8832c7026a7788e56c7e0d38902201c44ff3b4f9c555ed0e4ce64eee6ef3
SHA1 hash: 431eb9b23a23f0244cbfe6e4131993933cfb0568
MD5 hash: 810de81317d1fcc9369fba955c6f59a0
humanhash: beryllium-friend-march-floor
File name:TIN1-2007100001-AWB.JPG.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:409'479 bytes
First seen:2020-07-10 07:40:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:WF8O8pqlcFORVPCBkdfOsiyHrIS+wqgXECZLid7OvA19MtzEE1du17bgdmaLJY9I:Nt8RtCBk1Ospj+mLiQvA/kBdu54W8tws
TLSH CC9423A16D0B036D889AACF405833CDFCFD491B3E5F6A5B9D606230657ACD92B1109FB
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ghhaewae.com
Sending IP: 103.99.1.174
From: Kabir (Cutting) -IE <ie@ghhaewae.com>
Subject: RE: Emb & Printing Report
Attachment: TIN1-2007100001-AWB.JPG.zip (contains "TIN1-2007100001-AWB.JPG.exe")

AgentTesla SMTP exfil server:
mail.indoreisenslovenia.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b5515d79ca4186d8e22a6e41b5ce5f930b0082b745d07a5228a735c197d5afdf/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 07:41:05 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wviv26okigdnryrknza3lts7smfqbavxixihuuriu424df6vv7pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b5515d79ca4186d8e22a6e41b5ce5f930b0082b745d07a5228a735c197d5afdf

(this sample)

AgentTesla

Executable exe dc67ad0f1d9092eca89d3b0efc15e17b3490f9e90e99c5df611322053ce4c709

  
Dropping
MD5 d7dfb7d9efc85b906a72b2000f925061
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dc67ad0f1d9092eca89d3b0efc15e17b3490f9e90e99c5df611322053ce4c709

Comments