MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fcaec23e41d2eab49104b909756e3ca13149e6d5f42787708df32f9c1b149734. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fcaec23e41d2eab49104b909756e3ca13149e6d5f42787708df32f9c1b149734
SHA3-384 hash: 1e55f9ba6b9d2726bb5d61b22dca4685a729fff70a73dcf574e3205bd0a1f667bfa2ea6433ab2ba7d9e26d3dc1893eaa
SHA1 hash: 7daa6c5f1964652a03d86ed1753b92e01e328236
MD5 hash: 5ec41475120bf8f60fc8c5d50850de4b
humanhash: india-oklahoma-kansas-idaho
File name:Pedido Nova.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:675'390 bytes
First seen:2020-10-09 09:09:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:0OkntQkHQq9dVjBMOC7uuPRcPslb7XcMg1xsDrYs/7KGwVfLAPEv2+:0OaCqT3MF7ueR8IDcN128s/exiav
TLSH 1AE4333567DD7805E0BB2D32A718B204BFFA86734B949C679EBC50E84D6C9D8D5800AF
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: s35.mmteamservers.net
Sending IP: 188.164.192.118
From: GALLARDO azpeleta <autopalasvalladolld@autopalasvalladolid.com>
Subject: Pedido Nova
Attachment: Pedido Nova.zip (contains "LG3DzRSkwqC7qlI.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fcaec23e41d2eab49104b909756e3ca13149e6d5f42787708df32f9c1b149734/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 07:40:25 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7sxmepsb2lvljeiexeexk3r4ueyutzwv6qtyo4en6mxzygyus42a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.59
Link:
https://yomi.yoroi.company/submissions/fcaec23e41d2eab49104b909756e3ca13149e6d5f42787708df32f9c1b149734

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip fcaec23e41d2eab49104b909756e3ca13149e6d5f42787708df32f9c1b149734

(this sample)

AgentTesla

Executable exe 6564b76eec49b15e7a3f42b48fedca593b48e5f145863dd16ea519b3bcf09e60

  
Dropping
MD5 50a5e983ef9a4f960c3b799aa354c1a3
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6564b76eec49b15e7a3f42b48fedca593b48e5f145863dd16ea519b3bcf09e60

Comments