MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d908cb92569f29b7a48b9ebeb48f778b1370a80f89d0e4898bc20868a647139f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d908cb92569f29b7a48b9ebeb48f778b1370a80f89d0e4898bc20868a647139f
SHA3-384 hash: 5fd06fd7555990bb161b1a589dbaa8affebc2730c5ed1abbf7bb45cca00da5f81b9a072c5e8ea8ea3375966e345629c3
SHA1 hash: 0d47d14b55c3ded7d820e49c1d8b26103dbedd63
MD5 hash: e1092900ae65b4f3800f94ee8dc7f124
humanhash: three-six-virginia-fillet
File name:BOQ.PDF.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:473'908 bytes
First seen:2021-02-22 07:21:12 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:hYgbDnV/6Az8cylPVfS0F/g0CunwCrvlKFg:hRcAznyzS0/gynwCLlUg
TLSH 5CA4232233642F4C570F2E0A75A6F749512E745CCAADD28F651A9FD3A2107A898F343F
Reporter abuse_ch
Tags:cab


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: etr0.307.gvuwx.ml
Sending IP: 143.110.148.99
From: M. Hamza Burney <info@307.gvuwx.ml>
Subject: New Inquiry: Mat20210011.
Attachment: BOQ.PDF.cab (contains "BOQ.PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Bulz.366920.13999.16092.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d908cb92569f29b7a48b9ebeb48f778b1370a80f89d0e4898bc20868a647139f/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 07:22:06 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3eemxeswt4u3pjelt27ljd3xrmjxbkaprhiojcmlyiegrjshcopq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab d908cb92569f29b7a48b9ebeb48f778b1370a80f89d0e4898bc20868a647139f

(this sample)

AgentTesla

Executable exe 91d67e9fafdece29f904e3dfd8852d8d26d5c6102c0b3cf556d85cdae4d5d76c

  
Dropping
MD5 e74223e5ddec4cfcd6c7743e38081702
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 91d67e9fafdece29f904e3dfd8852d8d26d5c6102c0b3cf556d85cdae4d5d76c

Comments