MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32b45a96db1c62f7984b840fe5f2206d728207403c691ca1b00fc3fc75fc884b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32b45a96db1c62f7984b840fe5f2206d728207403c691ca1b00fc3fc75fc884b
SHA3-384 hash: d2dd1cc0fe8d6092eec144bdff238175fdfd3f4e5e2184f42e5d911ac71385de2b62d28f11e2df7d22062f8a0509f0df
SHA1 hash: e23b15b02401094f6c4a46f9acb56d84b30e55a3
MD5 hash: 0c2f3ca01a3e5f2a85348deba83bb328
humanhash: blue-alanine-hotel-skylark
File name:0003267Document.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:423'604 bytes
First seen:2020-07-30 05:15:48 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:fl7e1VkJ2O/SLqDy23TbD34Q4U7r7mVF/niTa+:fteYh/wqDyED34Q4OaVhM
TLSH 92942373C159634797343860EC282FFA46C6BF3C61A9A2CBA7405EAD84C7C7B6694731
Reporter cocaman
Tags:AgentTesla r00


Avatar
cocaman
Malicious email
From: Seiko Industrial Company Limited <sulibiao025@163.com>
Received: from cloudhost-505127.us-midwest-1.nxcli.net (cloudhost-505127.us-midwest-1.nxcli.net [104.207.254.173])
Date: Wed, 29 Jul 2020 17:15:46 -0700
Subject: RE: Payment Agreement
Attachment: 0003267Document.r00

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32b45a96db1c62f7984b840fe5f2206d728207403c691ca1b00fc3fc75fc884b/
Threat name:
Win32.Trojan.DataStealer
Create hunting rule
Status:
Malicious
First seen:
2020-07-30 05:17:05 UTC
File Type:
Binary (Archive)
Extracted files:
43
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gk2fvfw3drrppgclqqh6l4ranvzieb2ahrurzinqb7b7y5p4rbfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/32b45a96db1c62f7984b840fe5f2206d728207403c691ca1b00fc3fc75fc884b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 32b45a96db1c62f7984b840fe5f2206d728207403c691ca1b00fc3fc75fc884b

(this sample)

AgentTesla

Executable exe c0f37afa1a5f4a48d7f96c1be01fc0478a4f130f18ce931f6950156f61db7c23

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c0f37afa1a5f4a48d7f96c1be01fc0478a4f130f18ce931f6950156f61db7c23
  
Dropping
AgentTesla

Comments