MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3657a1394f263ff50185a7c29a72cbe1c6e8ba810912d64195fa67ba42b28519. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3657a1394f263ff50185a7c29a72cbe1c6e8ba810912d64195fa67ba42b28519
SHA3-384 hash: 4ed76dcc97197528491f4fd07a92d572f78ea19056de3751c96f42b55555f2b220c4ab8dba552de0812547eb765e40a3
SHA1 hash: 69a7f2cb97a214e1581e06081f790425f02c9b98
MD5 hash: 2b493ab1f672a6edcd56dcc4d257351f
humanhash: harry-cat-network-thirteen
File name:PEDIDO4965832-pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:275'013 bytes
First seen:2020-08-14 12:15:34 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:63xpOeDQws8AX/wtkCRJpFM0bt1MC/aGN7mr12fNpwLph0C:+XQ9/yXVpjdK2Sj
TLSH 094423CAFAF0256702730CAC7A2D3F686D28A2E6844581DE58BE67FCF1A751F604574C
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: lin.nbt.net.tr
Sending IP: 77.223.153.10
From: Penka Tzolova <p.tzolova@qualityintergroup.com>
Reply-To: Penka Tzolova <dustiutd12@hotmail.com>
Subject: NUEVO PEDIDO (POR FAVOR COTIZAR)
Attachment: PEDIDO4965832-pdf.7z (contains "PEDIDO#4965832-pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3657a1394f263ff50185a7c29a72cbe1c6e8ba810912d64195fa67ba42b28519/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 12:17:04 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gzl2cokpey77kamfu7bju4wl4hdoroubbejnmqmv7jt3uqvsqumq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3657a1394f263ff50185a7c29a72cbe1c6e8ba810912d64195fa67ba42b28519

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3657a1394f263ff50185a7c29a72cbe1c6e8ba810912d64195fa67ba42b28519

(this sample)

AgentTesla

Executable exe 8a47ce85d2c2f882b1f9e4e4a914ad8639a8a3d1c404d0b4dd555309097c768e

  
Dropping
MD5 5b167ef3acfaded616ee4dd16b7c35d6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8a47ce85d2c2f882b1f9e4e4a914ad8639a8a3d1c404d0b4dd555309097c768e

Comments