MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3dc2399972e1602f3b246bf255a1bf07b5e33fdc1f0b313209e7f72328dbb297. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3dc2399972e1602f3b246bf255a1bf07b5e33fdc1f0b313209e7f72328dbb297
SHA3-384 hash: 45146606aedde0276f8076a863ad6698e412b8e06e2e9c520b635b15f84552dc05ed304b11b678033f44f07fb2442ad2
SHA1 hash: b1cddc5746781c743f8d86e69c19437202fda01d
MD5 hash: 5767e1c74fefe8cec53e40bfe4ff8bee
humanhash: march-skylark-ohio-vermont
File name:Purchase Order (4502351248).7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:357'863 bytes
First seen:2020-09-10 05:26:37 UTC
Last seen:2020-10-15 09:38:35 UTC
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 6144:d3BkCjzrXgGGpXQWbY1GlNQDVTJVtZogQSfZXaOcb72o7KK/TR8u5fTD4:dfjApXbbEeNQDVjogQ8ZcbSopfLk
TLSH 60742380EBC24A74DDEB91FE59EC2CB3F96F1E1BC06D254473B11298918CDF49821AB4
Reporter cocaman
Tags:7z 94.156.175.95


Avatar
cocaman
Malicious email
From: Teodora Dinca <teodora.Dinca@garettmoion.com>
Received: from garettmoion.com (unknown [45.88.3.61])
Date: 9 Sep 2020 19:30:42 -0700
Subject: Purchase Orders (4502351248)
Attachment: Purchase Order (4502351248).7z

Intelligence

File Origin
# of uploads :
2
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3dc2399972e1602f3b246bf255a1bf07b5e33fdc1f0b313209e7f72328dbb297/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-10 00:35:36 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3dc2399972e1602f3b246bf255a1bf07b5e33fdc1f0b313209e7f72328dbb297

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 3dc2399972e1602f3b246bf255a1bf07b5e33fdc1f0b313209e7f72328dbb297

(this sample)

AgentTesla

Executable exe a9516c6968887596edb07b3af53bdefe21bb4fd4ea7a776448294f1d9abcf07a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a9516c6968887596edb07b3af53bdefe21bb4fd4ea7a776448294f1d9abcf07a

Comments