MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b882bee50f51ab84fb99616895a433c7e9bd1d99d650b5fdcf24acac4dd7389f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: b882bee50f51ab84fb99616895a433c7e9bd1d99d650b5fdcf24acac4dd7389f
SHA3-384 hash: 4a0af8b7ff11cd46b7117ddd247b940fffb68958aa53142089d11052b01884a4dc3da6840f4d61d28fb269db542e3258
SHA1 hash: eb4dcff8537c2a7506406c042a9ba821aaf6d74a
MD5 hash: a1a0880fd5725df360f1f03b6d5be5b0
humanhash: bacon-pennsylvania-california-summer
File name:USD56,440.81 payment advice note 16.06.2020.zip
Download: download sample
Signature AgentTesla
File size:981'539 bytes
First seen:2020-06-16 13:13:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:4J3UG1wGvymoBq7sAaFDfaBbGEmJEBxxzrq1U9+SddoiK:4JWmWq7sVfibRmJ+qi9DhK
TLSH 7E2533980EE555E1C623AA2F7DA9E19B649DA8CB0B0454420E0FCF4EF95DA77FC13182
Reporter @abuse_ch
Tags:AgentTesla zip


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: gmail.com
Sending IP: 103.99.2.4
From: Catherine Morrison - accounts dept HSBC<cath.morris@gmail.com>
Subject: Payment Advice Note dt. 16.06.2020
Attachment: USD56,440.81 payment advice note 16.06.2020.zip (contains "USD56,440.81 payment advice note 16.06.2020.exe")

AgentTesla SMTP exfil server:
smtp.sarniotex.com:587

Intelligence


File Origin
# of uploads :
1
# of downloads :
27
Origin country :
US US
Mail intelligence
Geo location:
Global
Volume:
High
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Wacatac
Status:
Malicious
First seen:
2020-06-16 13:15:05 UTC
AV detection:
24 of 31 (77.42%)
Threat level
  5/5

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b882bee50f51ab84fb99616895a433c7e9bd1d99d650b5fdcf24acac4dd7389f

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments