MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb59175ec049b96319dab72cd94b8ff51290752fdca6be52d05647eee542ee23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb59175ec049b96319dab72cd94b8ff51290752fdca6be52d05647eee542ee23
SHA3-384 hash: dcf9d3599a214bf67248336d914fb31c4c47302dc481855b7f40fd49daef0536a8a1f8b9b3bf2baf4f71e1a27e4f9d92
SHA1 hash: e1b938a995211d7073431cc2b5e0de3bd75a5720
MD5 hash: c91f90f6a6ddbdf52e0cacecad78c34e
humanhash: red-pizza-foxtrot-finch
File name:CATALOG.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:634'888 bytes
First seen:2020-08-17 08:58:51 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:lg3q1LV9iuzedyGPSJoXq04WVur5Qa+VVeGiD1IlU/zMuKJlIxcDQWEoB0:XV9iddXSJoXqbRQa+VVpg1T/wuKvOWx0
TLSH 85D423349117278D75A37937ABC6B6B264D16E08F7E0CF925D40737A024C798CAA3CA7
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: regular1.263xmail.com
Sending IP: 211.150.70.201
From: 上海科瑞 <sh-tcp@tcppioneer.com>
Subject: Re: shangai tcp inquiry
Attachment: CATALOG.7z (contains "PI10093724.exe")

AgentTesla SMTP exfil server:
mail.dogulumetal.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb59175ec049b96319dab72cd94b8ff51290752fdca6be52d05647eee542ee23/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 09:00:09 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7nmroxwajg4wggo2w4wnss4p6ujja5jp3stl4uwqkzd65zkc5yrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fb59175ec049b96319dab72cd94b8ff51290752fdca6be52d05647eee542ee23

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z fb59175ec049b96319dab72cd94b8ff51290752fdca6be52d05647eee542ee23

(this sample)

AgentTesla

Executable exe f23413f3d97714d09381d4863184e2689208879f1117f28f5b105e0894ad0818

  
Dropping
MD5 9b4dc53cf425c08e453303f9b8e54e0f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f23413f3d97714d09381d4863184e2689208879f1117f28f5b105e0894ad0818

Comments