MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0287e6612590d3b88ae7e2600a3ab1d1dbff1aba683c1dcb59185c5bd4fd46d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0287e6612590d3b88ae7e2600a3ab1d1dbff1aba683c1dcb59185c5bd4fd46d0
SHA3-384 hash: 346d5c7b925faa6bedbf110a792a280bd879693de74733c8bc8eeb8f44f7b82ba23088c5dc80399fe384e4b7bff0f720
SHA1 hash: 9209c9545cfb343bcd6a92554923a3a978fe5b5f
MD5 hash: 93becf568af7449476c277eb1428fd28
humanhash: tennis-salami-apart-wolfram
File name:PO - RFQ # 097663899 NEW ORDER.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:462'099 bytes
First seen:2020-05-06 16:36:36 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:qNLcp2YW9YqPhvHnHcSZAr4+vCS1nkx9lnx:sLpl9JhvnHcSZAM+Fkx9Rx
TLSH 3BA4235CF1CB3AF89FC567E15DA1829F6EF71B2D1A81398BE2DE404481B3DEA0C05265
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: Nishant Rajeev <sales@national-enterprises.com>
Received: from national-enterprises.com (unknown [209.58.149.69])
Date: 6 May 2020 14:34:15 -0700
Subject: PO - RFQ # 097663899 NEW ORDER
Attachment: PO - RFQ # 097663899 NEW ORDER.pdf.gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 20:16:00 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
12 of 31 (38.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=akd6myjfsdj3rcxh4jqauovr2hn76gv2na6b3s2zdbofxvh5i3ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 0287e6612590d3b88ae7e2600a3ab1d1dbff1aba683c1dcb59185c5bd4fd46d0

(this sample)

AgentTesla

Executable exe abb2ca1cb01da304c165330c9abd9d084c90e30ceedf5e225c3981b28372b98c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 abb2ca1cb01da304c165330c9abd9d084c90e30ceedf5e225c3981b28372b98c
  
Dropping
AgentTesla

Comments