MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bab107eaf1a3e53e211fb52b87948dac02c5d0e33521a94f367d5e8c42ffed58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bab107eaf1a3e53e211fb52b87948dac02c5d0e33521a94f367d5e8c42ffed58
SHA3-384 hash: d8bd404ac09f8c900780ca5ee08062af03f4cd9875a03b3cc5566f45dbffcca78115ac829a481caa1b47e5bcaef8ad0c
SHA1 hash: c4835d414fd63feedc68e0548d16262357465e2c
MD5 hash: 3bb2d69649607fbc00c4d9d59ba9ea2a
humanhash: kansas-montana-apart-monkey
File name:PO.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:373'373 bytes
First seen:2020-09-29 09:33:25 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:fSdk4T6ewI9VpyOS2LjLMGs6cxW2uJIUpCmTntqfkca69BadkxeY2pdkF+3AsTZl:fSdk46I9K23LjsrDuJdEsntd6+kV6dkA
TLSH 948422F694E3039694C0EDDEEED4BB1325FE694168E69438BAF9CDF0B45081F9129306
Reporter cocaman
Tags:AgentTesla z


Avatar
cocaman
Malicious email (T1566.001)
From: "GENERAL ENGINEERING CO., LTD<rud-division@alkuhaimi.com>"
Received: "from alkuhaimi.com (unknown [209.58.149.73]) "
Date: "29 Sep 2020 07:32:18 -0700"
Subject: "Re-send PO pending in system"
Attachment: "PO.pdf.z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200930-0805.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bab107eaf1a3e53e211fb52b87948dac02c5d0e33521a94f367d5e8c42ffed58/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-09-29 09:35:07 UTC
File Type:
Binary (Archive)
Extracted files:
40
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xkyqp2xrupst4ii7wuvypfenvqbmluhdguq2stzwpvpiyqx75vma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bab107eaf1a3e53e211fb52b87948dac02c5d0e33521a94f367d5e8c42ffed58

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z bab107eaf1a3e53e211fb52b87948dac02c5d0e33521a94f367d5e8c42ffed58

(this sample)

AgentTesla

Executable exe 58f57f10db219449f530a5856c1e3fee44cbca44a55828b55a1445a5164b6257

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 58f57f10db219449f530a5856c1e3fee44cbca44a55828b55a1445a5164b6257

Comments