MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2f16254098e62e39dda23c727b26051af6b9c55667a6c781875e4326add45d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2f16254098e62e39dda23c727b26051af6b9c55667a6c781875e4326add45d7
SHA3-384 hash: fd42262d2a7ca5bb370c1289e9071ed29e8354aaa4935b817a0f353b6425541c665dd2cf92df6b526ed45985c6b10eda
SHA1 hash: 7717389af848d142433368ce93236efc15e1d240
MD5 hash: 180c496c564fb1b6a31de20f7a67b785
humanhash: diet-april-angel-north
File name:Oferta OF-201781.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:545'454 bytes
First seen:2020-08-11 11:04:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:zx8eXRObtiVAlrC9VK4zk/FV7LwoI8puUXSG4xm4:pBObtAlVtzk/wof4Utp4
TLSH 14C42387F46CF7E7D0B62A2119EEC47E52E1D42774B2BDA826F2120BA7461E50047B4F
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: blue104.dnsmisitio.net
Sending IP: 186.64.119.226
From: Hector Magaña Suelves <hmagana@cafgroup.net>
Subject: ENQUIRY
Attachment: Oferta OF-201781.zip (contains "Oferta OF-201781.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FYE1059213E2920.5570.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2f16254098e62e39dda23c727b26051af6b9c55667a6c781875e4326add45d7/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 11:06:08 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6lywevajrzrohho2epdspmtakgxwxhcvmz5gy6ayoxsde2w5ixlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/f2f16254098e62e39dda23c727b26051af6b9c55667a6c781875e4326add45d7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f2f16254098e62e39dda23c727b26051af6b9c55667a6c781875e4326add45d7

(this sample)

AgentTesla

Executable exe 0e9f18832b1738b5db30853fc3732e4a083722f7d99db5e62c8dc3d42e5cae70

  
Dropping
MD5 1059213e29209179dcefd96630c8bbed
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0e9f18832b1738b5db30853fc3732e4a083722f7d99db5e62c8dc3d42e5cae70

Comments