MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a8aa0fa8262e0259184cae0d1de7c81e87ce625c9053db0f924e41996a3ef3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a8aa0fa8262e0259184cae0d1de7c81e87ce625c9053db0f924e41996a3ef3c
SHA3-384 hash: 9e867ec7d96a256538e1ac02b9e9c6cdc32484eb28c0efa315f6367a8cd09f54eb4c7b482a862992fabb358077ae9912
SHA1 hash: c6b1f7b7fa62ef735e35de68de90e64a10ec5fab
MD5 hash: 05b6f08186cebb6b4ba2795f256ca467
humanhash: salami-sodium-black-single
File name:PO # 39619.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:604'160 bytes
First seen:2020-05-21 14:08:50 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:145d0O4vuzUSEoE8u+WqbdEXe0nY8MrXkwx3EKItA4:+Tb4vkUIE6tipY8MrJx3b4
TLSH A3D412983BF86B54F1A54BF018311990377BBA5B5633D70C2D5975CE2E33B828692B23
Reporter cocaman
Tags:AgentTesla img


Avatar
cocaman
Malicious email
From: Cardinale, Caroline <CCardinale@zwillingus.com>
Received: from zwillingus.com (unknown [185.222.58.111])
Date: 21 May 2020 04:46:08 -0700
Subject: New Purchase Order # 39619
Attachment: PO # 39619.img

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25544.7zHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 12:33:18 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
15 of 31 (48.39%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 4a8aa0fa8262e0259184cae0d1de7c81e87ce625c9053db0f924e41996a3ef3c

(this sample)

AgentTesla

Executable exe 983ba36cf30568b97a4a1b96caf12fd7defe990904de6b3c7c4d720459dee8da

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 983ba36cf30568b97a4a1b96caf12fd7defe990904de6b3c7c4d720459dee8da
  
Dropping
AgentTesla

Comments