MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba5e25996b6e8a6c894efc37abb8668ce672cece03ad4defd97cc44a37e90803. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba5e25996b6e8a6c894efc37abb8668ce672cece03ad4defd97cc44a37e90803
SHA3-384 hash: 3ea1fd91446db9ab913271d7c3f4e6b9c4f27fdc455b8fcec4e5e7c7e9cdacf44946b9ee450f601499a04979f7acb61f
SHA1 hash: f8c74a7798ae541a36a7450364fb9958332874d3
MD5 hash: 4b0c13c09f58250e18f5c154cf0dccaf
humanhash: robin-william-neptune-zebra
File name:Scan3021352.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:561'292 bytes
First seen:2020-10-11 07:59:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:JoZP8DnB45wGGGR3ozswT4Z246x0vP+3G7xfhelrNH0KBTrp7U7:JlnBqR3SswT4I4Bvtbef0EU7
TLSH 63C423AFC98C307ACFD681E0F50D9584A2347F7EE645E86424A74DE4C392209ABD9C77
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp.livemail.co.uk
Sending IP: 213.171.216.60
From: <studio@marcregas.com>
Subject: Offer No. 3021352 / Inquiry No.120...
Attachment: Scan3021352.zip (contains "Scan3021352.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba5e25996b6e8a6c894efc37abb8668ce672cece03ad4defd97cc44a37e90803/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-10 23:24:59 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xjpclglln2fgzcko7q32xodgrtthftwoaowu336zptceun7jbabq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba5e25996b6e8a6c894efc37abb8668ce672cece03ad4defd97cc44a37e90803

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ba5e25996b6e8a6c894efc37abb8668ce672cece03ad4defd97cc44a37e90803

(this sample)

AgentTesla

Executable exe 3f43734203085807cedfed30238b76d87142676522a4ba35270c3da7a26d2d6f

  
Dropping
MD5 e882970d19cbfd8f22988a88691c6f7a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3f43734203085807cedfed30238b76d87142676522a4ba35270c3da7a26d2d6f

Comments