MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ffc8134f0703c5e26c91fd163acfa4eb5d07e10178bb2bdb696bafd134fa44bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ffc8134f0703c5e26c91fd163acfa4eb5d07e10178bb2bdb696bafd134fa44bc
SHA3-384 hash: 3b973239c9ecb9bb1d1259830bbeb7bf58693e11851882af053bfb096a17db18813683b3c42571eb0da8c5c3d9907376
SHA1 hash: 4e46f417810aaa897f434fab36a8d96a7dd41450
MD5 hash: d3f86ceca1597f2d57c52336fbfc779b
humanhash: fix-paris-michigan-florida
File name:Bank transfer 101875411.r01
Download: download sample
Signature AgentTesla
Create hunting rule
File size:571'515 bytes
First seen:2020-07-09 07:32:39 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 12288:0l4GiKCRz7lUoGs6INcOfMGjl2Nt3XRQCXzyZsJH3y6MYA3Q5ER/mlowNB1Y:YklUxs6I2k5lE3XuNs1XMx3/rwNBq
TLSH 50C423AC8B893F5950830FE0125CCCB97ADDDF8F6746076D89FDA941E390E68ADD2484
Reporter abuse_ch
Tags:AgentTesla HSBC r01


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 2biwhlr.ni.net.tr
Sending IP: 94.102.15.57
From: HSBC <info@yhsbc1.com>
Subject: Incoming Foreign Transfer Payment
Attachment: Bank transfer 101875411.r01 (contains "Bank transfer 101875411.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ffc8134f0703c5e26c91fd163acfa4eb5d07e10178bb2bdb696bafd134fa44bc/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 07:34:09 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=77ebgtyhapc6e3er7uldvt5e5noqpyibpc5sxw3jnox5cnh2is6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r01 ffc8134f0703c5e26c91fd163acfa4eb5d07e10178bb2bdb696bafd134fa44bc

(this sample)

AgentTesla

Executable exe 2ad7e2382efb6fe85a117f20f192029091cfaeebc7a17f4164b158ab63874d94

  
Dropping
MD5 63ae29ac0a6b9f29fc1567ecf244db7d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2ad7e2382efb6fe85a117f20f192029091cfaeebc7a17f4164b158ab63874d94

Comments