MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6ec8fd5630c343c499f5fa243983910c17750c0a68c9212b8e6f56fd8a5bfde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6ec8fd5630c343c499f5fa243983910c17750c0a68c9212b8e6f56fd8a5bfde
SHA3-384 hash: aec9290090c8956a1d2e92b2876535224ce6f184f8ddd6597d741411e96ef2a8c7803297539db3e1b4af090601664c86
SHA1 hash: 3f7e66f636b7e49045dca4d0f26eb5aef143c9c7
MD5 hash: b427b087bebeec8247629e3c64760a3e
humanhash: earth-tango-mirror-table
File name:Payment Transfer, order PO-1236-ES-MCB-DV-18.R12
Download: download sample
Signature AgentTesla
Create hunting rule
File size:833'193 bytes
First seen:2021-04-06 07:20:48 UTC
Last seen:2021-04-07 04:07:11 UTC
File type: rar
MIME type:application/x-rar
ssdeep 24576:aAoSNXPS5yuHH07VWewFEgUuJR9vIoc+biNPzp691:ad6fS5nn01p0TvHcvNS1
TLSH 950533627DAD5EB8718134E805D36FF13419D0147D1AEEA6BEA8375C98738C1A90EF23
Reporter cocaman
Tags:AgentTesla r12


Avatar
cocaman
Malicious email (T1566.001)
From: "Edward James <export@novex.it>" (likely spoofed)
Received: "from novex.it (unknown [84.38.135.208]) "
Date: "06 Apr 2021 19:03:39 +0300"
Subject: "Payment Transfer, order PO-1236-ES-MCB-DV-18"
Attachment: "Payment Transfer, order PO-1236-ES-MCB-DV-18.R12"

Intelligence

File Origin
# of uploads :
7
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e6ec8fd5630c343c499f5fa243983910c17750c0a68c9212b8e6f56fd8a5bfde/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 07:21:04 UTC
File Type:
Binary (Archive)
Extracted files:
36
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=43wi7vldbq2dysm7l6rehgbzcdaxougau2gjeevy432w7wffx7pa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e6ec8fd5630c343c499f5fa243983910c17750c0a68c9212b8e6f56fd8a5bfde

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e6ec8fd5630c343c499f5fa243983910c17750c0a68c9212b8e6f56fd8a5bfde

(this sample)

AgentTesla

Executable exe c6001e599745f9e8b432fcfdcb2d5001d1b2c56871db82ecea6882e2d48cd67f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c6001e599745f9e8b432fcfdcb2d5001d1b2c56871db82ecea6882e2d48cd67f
  
Dropping
AgentTesla

Comments