MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c3cea6e16788b638baa8e39aae0d5cd4ed4defec0798916b3f3adb47b9961ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c3cea6e16788b638baa8e39aae0d5cd4ed4defec0798916b3f3adb47b9961ff
SHA3-384 hash: 5f7b8766b7f3276fb54fdf82436b23ef091f9b3d7c52e85f3001e6b025b6c00292c7cd0eee621da85bd9ac4f9561c549
SHA1 hash: 312b52f515428c98120fe5b3f2bb2397b0dbd266
MD5 hash: e1608f570009b5d87f48e88f8ffedea4
humanhash: carpet-shade-nineteen-charlie
File name:Order_903939_pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:444'966 bytes
First seen:2020-04-22 07:26:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:EMq9E2U1OGksOxFlGEgh5wh0z7dHmurca4:EMqiZPktxrGEUwmz7drQ
TLSH 1D9423A6F02AF50BDD5C0DA5D2549CBB60D9AC1253FD00D598F0A4C71EAE702A0F63BE
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email
From: Purchase-2 <rud-division@alkuhaimi.com>
Received: from alkuhaimi.com (unknown [212.32.245.155])
Date: 21 Apr 2020 23:12:54 -0700
Subject: Order-044485

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisCAC1E2669F05.25033.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22887.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-21 23:39:34 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
23 of 31 (74.19%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dq6ou3qwpcfwhc5kry42vygvzvhnjxx6yb4ysfvt6ow3i64zmh7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1c3cea6e16788b638baa8e39aae0d5cd4ed4defec0798916b3f3adb47b9961ff

(this sample)

AgentTesla

Executable exe b329eaed95e45912929ff78f995330bb03eb3f2b1dcd349a3069192812a6fc4f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b329eaed95e45912929ff78f995330bb03eb3f2b1dcd349a3069192812a6fc4f

Comments