MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 baace88041fa051fb7360a7c2ac5a37177f2e16cbceaf96d9f23d03dfa596eae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: baace88041fa051fb7360a7c2ac5a37177f2e16cbceaf96d9f23d03dfa596eae
SHA3-384 hash: 3f2b41e340b5c61392490deb3ff9aa118b56c54297e8aefe3353c61ca88a83fa5fd3c73e71cf0821c0c05d78f142f2fb
SHA1 hash: e23e262cdd81f9b4df0110ae6ab654fa083686e6
MD5 hash: 79d83dbae232e16382cffd449a1c7456
humanhash: three-skylark-skylark-delta
File name:Yhl202000233_oo3.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:449'824 bytes
First seen:2020-08-18 12:46:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:08D4NXHgNeQAs91t2f1YypZNHLR6MNJFrXj70S4Abt/XLCrZSB77BUuu/bgCVjtT:08qkeXLf1YCrXH54Sj/bQZI77BLu//V1
TLSH 02A4230DB8B892DA0E4D868E7B8C238FD97E6D42B53EE144CB62D4953B61C2671D11CB
Reporter abuse_ch
Tags:AgentTesla MailChannels zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: brown.birch.relay.mailchannels.net
Sending IP: 23.83.209.23
From: chenglei@sublimitemail.xyz
Subject: RE: FOB kaohsuing to Riyadh (Alsamasy) 3x40HQ S/元山工業
Attachment: Yhl202000233_oo3.zip (contains "Yhl202000233_oo3.exe")

AgentTesla SMTP exfil server:
mail.puntomesa.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/baace88041fa051fb7360a7c2ac5a37177f2e16cbceaf96d9f23d03dfa596eae/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 12:48:05 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xkworacb7icr7nzwbj6cvrndof37fylmxtvps3m7epid36szn2xa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/baace88041fa051fb7360a7c2ac5a37177f2e16cbceaf96d9f23d03dfa596eae

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip baace88041fa051fb7360a7c2ac5a37177f2e16cbceaf96d9f23d03dfa596eae

(this sample)

AgentTesla

Executable exe 7cc4e45a2448e81c638cf0a84c269d7d926135647f95d318279429587d462e9a

  
Dropping
MD5 082fbe66f906371b4f3f9dc420f98370
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7cc4e45a2448e81c638cf0a84c269d7d926135647f95d318279429587d462e9a

Comments