MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2212302c584862999b02eebef432076b5098285eb42ac8f67ecb64d4deee4be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d2212302c584862999b02eebef432076b5098285eb42ac8f67ecb64d4deee4be
SHA3-384 hash: a3c45aa28add7c8e7e3692ae66488e667d4f0e756d819cf8be2e4340ab411e854ef9d2fa13ec406495bf7056a741c9ad
SHA1 hash: e9a217d309766f224767512d446185317238744e
MD5 hash: b517d3f414bc0fa9b32fd35b7029dca9
humanhash: eighteen-black-delaware-michigan
File name:PO.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:394'578 bytes
First seen:2020-06-04 04:58:03 UTC
Last seen:2020-06-04 14:18:31 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:jmbdHkc4tGLjwiN5bCVB+1ufaS/uDR14HDLEdHQnh5A7RB:jmbdH5wGQiNU/+4V/jomUFB
TLSH 448423F9850EA4457CD7444CCF9ABF9B206803B4A06D9F212A79F9481D94F01B35EEFA
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
3
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21241.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 05:36:13 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2iqsgawfqsdctgnqf3v66qzao22qtauf5nbkzd3h5s3e2tpo4s7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d2212302c584862999b02eebef432076b5098285eb42ac8f67ecb64d4deee4be

(this sample)

AgentTesla

Executable exe 30ba25549a02c9906ffeb63f7a26619131169cb79b193043b821d13c756ef814

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 30ba25549a02c9906ffeb63f7a26619131169cb79b193043b821d13c756ef814
  
Dropping
MD5 b330a657c55b22f8ea56a096f82ae1d6

Comments