MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32fdf3c0706b25cf62e285adbe6959df0251a6972d5414f5175973f34b9d51b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32fdf3c0706b25cf62e285adbe6959df0251a6972d5414f5175973f34b9d51b7
SHA3-384 hash: 6564367c62c4d6d06c75932d20406f654db4645d9da57ff68a8988e2290e3bd8ce64fc22ec0ce2f51e2709eb192e7ce3
SHA1 hash: e8863827b58d5c0ad4baf2218439073eead07923
MD5 hash: af4948c9b8e7ad6d0eef59a44f2e6164
humanhash: august-wolfram-wyoming-zebra
File name:Order List & IMGS_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:218'279 bytes
First seen:2020-08-29 08:10:09 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:vUKPpbxQBwD7Pu6NjVCD/6ewUhkPqWmjcxjUWGd4NOw3U:cKPFxQBwf1O/6t6HWmWjUv4lk
TLSH 812423266E5E2EF5C61D6638933C1F8891E6D4865D3F20B74EED39E86048FD171320B2
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email
From: Jessie Xi<jessie.xi@cn.dsv.com>
Received: from cn.dsv.com (unknown [185.121.139.46])
Date: 27 Aug 2020 18:51:17 -0700
Subject: =?UTF-8?B?RlfvvJrmiJHnmoTlrqLmiLfnmoTorqLljZXmn6Xor6LvvIjntKfmgKXvvIk=?=
Attachment: Order List & IMGS_pdf.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32fdf3c0706b25cf62e285adbe6959df0251a6972d5414f5175973f34b9d51b7/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 10:31:13 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gl67hqdqnms46yxcqww342kz34bfdjuxfvkbj5ixlfz7gs45kg3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/32fdf3c0706b25cf62e285adbe6959df0251a6972d5414f5175973f34b9d51b7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 32fdf3c0706b25cf62e285adbe6959df0251a6972d5414f5175973f34b9d51b7

(this sample)

AgentTesla

Executable exe a1e3f34c862762fa11d8cc18239cf15d4fd9404e81f064baa6c3a9415fd6a7e0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a1e3f34c862762fa11d8cc18239cf15d4fd9404e81f064baa6c3a9415fd6a7e0
  
Dropping
AgentTesla

Comments