MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f63fb93e43fa6ada8fbb27001677b4e3c1bf79358d9817ed0e9337ef4e78f891. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f63fb93e43fa6ada8fbb27001677b4e3c1bf79358d9817ed0e9337ef4e78f891
SHA3-384 hash: 181b9edff2f20d9a90b70d49e9cb5c7b99d9fcf8287a6d835903aecb643972e52999dd52fce07b4fe1b7a7a559133240
SHA1 hash: 8eef0b08e06d6e68c70a40fb9b4419132fc78598
MD5 hash: 24781d016bbabd4eebff5a18f67d5858
humanhash: five-charlie-texas-bravo
File name:Ref08062020.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:460'736 bytes
First seen:2020-08-08 08:14:21 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:6vz0mjQ+HRe4lKaaWX0hc91o6X/WJLcsJxxuymAN6lSiA:6Lpj9ZE8XZo6X/Wtxxuyme6M
TLSH 5AA4236BFC96BBC223C4D903F429AC6C93934F484433BA73612FC9DD96E68249A5D345
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ucmchile.cl
Sending IP: 185.222.57.157
From: Sandra Caro <scaro@ucmchile.cl>
Subject: Re: DEVOLUCIÓN DE PAGO TT (Ref No.08072020)
Attachment: Ref08062020.gz (contains "Ref08062020.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f63fb93e43fa6ada8fbb27001677b4e3c1bf79358d9817ed0e9337ef4e78f891/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-08 08:16:06 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6y73spsd7jvnvd53e4abm55u4pa366jvrwmbp3iosm366tty7ciq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f63fb93e43fa6ada8fbb27001677b4e3c1bf79358d9817ed0e9337ef4e78f891

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz f63fb93e43fa6ada8fbb27001677b4e3c1bf79358d9817ed0e9337ef4e78f891

(this sample)

AgentTesla

Executable exe f5ca4644c1340cd373374d09ecd052c57c8c8abef50c4ae280876497d3f40a64

  
Dropping
MD5 cb01f4123e35bfd143e6fb2cd4b29976
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f5ca4644c1340cd373374d09ecd052c57c8c8abef50c4ae280876497d3f40a64

Comments