MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f97158365c5e5346e90a879f47cd57c97f1048df611f003781721076044d60c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f97158365c5e5346e90a879f47cd57c97f1048df611f003781721076044d60c5
SHA3-384 hash: 59c21029840e2f8c20f58b2e2fe591d1cfcdec8c6b5786bb791ad9bd46813089a95e18ec3f46a38b5a5f624a5b4d9e54
SHA1 hash: a58467594069b700761a34d546898f751196d8b3
MD5 hash: 8144b854ea202475db3541c70edfd626
humanhash: washington-violet-pluto-lima
File name:Conakry_111120.pdf.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:428'369 bytes
First seen:2020-11-11 19:14:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:qUfB69GkhlUfzb8emCP3F9LUYWiWcjUaydmza:qwBQZIP3FiYWozza
TLSH 75942353781FF88D3309B934799C4C8B76C6D161B4C3A41A6ACA6B8D80CB6ED9730D6D
Reporter fabjer

Intelligence

File Origin
# of uploads :
1
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Generic.mg.54d657c9a3d9b7b4.23175.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f97158365c5e5346e90a879f47cd57c97f1048df611f003781721076044d60c5/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 10:20:48 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7fyvqns4lzjun2ikq6puptkxzf7rasg7mepqan4boiihmbcnmdcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f97158365c5e5346e90a879f47cd57c97f1048df611f003781721076044d60c5

(this sample)

AgentTesla

Executable exe ca7beb7680e56c787ab0e04634f813dbeda9ce2ac1469b86ac50ba97a797180b

  
Dropping
SHA256 ca7beb7680e56c787ab0e04634f813dbeda9ce2ac1469b86ac50ba97a797180b
  
Delivery method
Distributed via e-mail attachment

Comments