MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5e242366fdb2c02a133299a12e8656764bc27c1473c72d31459e4a4f1bbd991. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5e242366fdb2c02a133299a12e8656764bc27c1473c72d31459e4a4f1bbd991
SHA3-384 hash: 87497ac9f99c61a3d64eeab564c0d6b2812f9a794409a904b0443f3e2781a3f72fe12ea8c54b2266f1fbf35ac3030ffc
SHA1 hash: f4c980e3e782f188724d1b8e858e6ef1bc71bfd4
MD5 hash: b2846d47ac96a34758392e20414b456f
humanhash: sixteen-tango-two-avocado
File name:Order-List-1190187289-00405510257.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:28'150 bytes
First seen:2020-08-31 09:26:55 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:QIaXmBnrRou0SZJSqI3yGHEvILUOlSROgF5NSGLfz:QIaXmBJRZJSFiGkAUFROcUGLfz
TLSH 54C2E194D282C81FE8CFADF524F2621C55906A4746F13F54CB9BEC9663BD22196E2C3C
Reporter abuse_ch
Tags:ace AgentTesla Hostwinds


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hwsrv-762688.hostwindsdns.com
Sending IP: 104.168.158.121
From: Ali Humdin<info@buttima.com>
Reply-To: <alihumdin1@inbox.lv>
Subject: I need a quotation
Attachment: Order-List-1190187289-00405510257.ace (contains "Order-List-1190187289-00405510257.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5e242366fdb2c02a133299a12e8656764bc27c1473c72d31459e4a4f1bbd991/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 03:07:53 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yxreentp3mwafijtfgnbf2dfm5slyj6bi46hfuyulhskj4n33giq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c5e242366fdb2c02a133299a12e8656764bc27c1473c72d31459e4a4f1bbd991

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c5e242366fdb2c02a133299a12e8656764bc27c1473c72d31459e4a4f1bbd991

(this sample)

AgentTesla

Executable exe d3f6b0b7336fee85292bc3b1f5634f113b561b9c5205f1ac319949628ba281ba

  
Dropping
MD5 ec1f4d605cd1dce540f469c4dc31ee4b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d3f6b0b7336fee85292bc3b1f5634f113b561b9c5205f1ac319949628ba281ba

Comments