MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77997b200e57f05dce3d2f9d021a3b795f30c6f8b0d05a4a0d86152a1b8313d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77997b200e57f05dce3d2f9d021a3b795f30c6f8b0d05a4a0d86152a1b8313d5
SHA3-384 hash: 97c5ceb6ac8ae9afc754b7042c8e3eddf7e30e2f850a6373c0e956354f389c1103e88043e33f1d80e943e55afbced67d
SHA1 hash: 6d32af8f730bd1527ddd5543797bb0761ce1acda
MD5 hash: e5df5e6d45741eba03d0070acf28aa85
humanhash: failed-bulldog-carolina-vegan
File name:Purchase Order.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:676'827 bytes
First seen:2020-09-03 05:43:40 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:MVib+P72NhCZ6HlfdvzvlpHlpEhI6reFzTulosxOsMR0xrLmSaJR9qZ60DMyTTDE:8nP7GCZC5zvlD6reYGIrLzapqMryTE
TLSH A2E42397E28A2D065E704ED6A135E0DD514B04AE72D7B386C1CEF64A2146D7123F8FCD
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email
From: NKTECH Kwon <kwon@nktech.com.sg>
Received: from properso.com (62-210-157-138.rev.poneytelecom.eu [62.210.157.138])
Date: Thu, 03 Sep 2020 06:07:26 +0100
Subject: Purchase Order
Attachment: Purchase Order.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25065.RarHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/77997b200e57f05dce3d2f9d021a3b795f30c6f8b0d05a4a0d86152a1b8313d5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-03 04:48:43 UTC
File Type:
Binary (Archive)
Extracted files:
42
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o6mxwiaok7yf3tr5f6oqegr3pfptbrxywdifusqnqyksug4dcpkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/77997b200e57f05dce3d2f9d021a3b795f30c6f8b0d05a4a0d86152a1b8313d5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 77997b200e57f05dce3d2f9d021a3b795f30c6f8b0d05a4a0d86152a1b8313d5

(this sample)

AgentTesla

Executable exe 62ec54be232c964bfd6b4c669c331079f6830f688291cbe9e0f079924a9a3253

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 62ec54be232c964bfd6b4c669c331079f6830f688291cbe9e0f079924a9a3253

Comments