MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fcee1cd5be984b20bfed684bfcf904ddccad2f90f11d794ff9ee5313363b148. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3fcee1cd5be984b20bfed684bfcf904ddccad2f90f11d794ff9ee5313363b148
SHA3-384 hash: 3d91ab8f85264a2d11bd286c1e87be22f7762986848233b204bd195805414cbb2efdf9ac39f8956a7faf4484e9a87064
SHA1 hash: 7bdf43ef5842dedf8e50fcc29becbf1fc10c60e3
MD5 hash: d47cf54c2458657509a7d59e4d5ba47d
humanhash: happy-artist-hydrogen-burger
File name:PO2302D-05252020.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-25 07:53:36 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:mK6Agv1zeRzriNuXzG9MKzF40bRO2vJojhr:mZvYRzrkuXzG9RppbRO2vKhr
TLSH 6445D01C675C3E27EA7D4A38E0A5410C72EBCD369653EB99E89631E50BB7383F902147
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: srv2.trendstudio.it
Sending IP: 62.116.182.204
From: HUIFANG <yuhsihara@yahoo.com>
Subject: 紧急PO#2302D-05252020
Attachment: PO2302D-05252020.IMG (contains "PO#2302D-05252020.scr")

AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.UCB.26671.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 08:36:12 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 3fcee1cd5be984b20bfed684bfcf904ddccad2f90f11d794ff9ee5313363b148

(this sample)

AgentTesla

Executable exe 4e30c34466bc79b5a233037bb7ad896604645afd2f912c41538a48b9085e75a2

  
Dropping
MD5 944add6d7a8d0ae9a3910c9a73f96891
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4e30c34466bc79b5a233037bb7ad896604645afd2f912c41538a48b9085e75a2

Comments