MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b81b8ef9a855d27e29797516ca0bacb1e7ad64724abf39818ff10ab013c10d8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b81b8ef9a855d27e29797516ca0bacb1e7ad64724abf39818ff10ab013c10d8c
SHA3-384 hash: 91b269052f165812a8e528d2d1d5132c7534279dd28d31df81f149f478f55cb4576aec4676c00b0f6167a0bcf618873b
SHA1 hash: e791207966ed0ddedb426df977cf5b4b4d9e445e
MD5 hash: 685a478bca937f57c97fb96064d07bcc
humanhash: maryland-violet-bakerloo-nebraska
File name:SalesOrd_4552-228.PDF.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:429'737 bytes
First seen:2020-09-14 15:36:32 UTC
Last seen:2020-09-14 20:06:49 UTC
File type: z
MIME type:application/x-rar
ssdeep 12288:vsyi7q2l2a/MyobhIuacHz5vqJFET76Qbw:7Ml2a/Uhl3HFqJFq7C
TLSH 92942315BAFC8132C6A5182EBF429755EC6DFE8C52332AA8A83C6314F5C9D436F1F650
Reporter cocaman
Tags:AgentTesla z


Avatar
cocaman
Malicious email
From: Maria Booyen<manager@skdm.co.za>
Received: from skdm.co.za (unknown [103.153.182.164])
Date: 14 Sep 2020 11:23:38 -0700
Subject: RE: New Inquiry
Attachment: SalesOrd_4552-228.PDF.z

Intelligence

File Origin
# of uploads :
2
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200915-0757.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b81b8ef9a855d27e29797516ca0bacb1e7ad64724abf39818ff10ab013c10d8c/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-09-14 14:23:15 UTC
File Type:
Binary (Archive)
Extracted files:
82
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xany56nikxjh4klzoulmuc5mwht22zdsjk7ttamp6eflae6bbwga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b81b8ef9a855d27e29797516ca0bacb1e7ad64724abf39818ff10ab013c10d8c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z b81b8ef9a855d27e29797516ca0bacb1e7ad64724abf39818ff10ab013c10d8c

(this sample)

AgentTesla

Executable exe 28af2ba9b0384e3d4f9754ee8a62bb812c9a4d39bad72a56c38e75b38578537c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 28af2ba9b0384e3d4f9754ee8a62bb812c9a4d39bad72a56c38e75b38578537c
  
Dropping
AgentTesla

Comments