MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 318bc669d7b4a1bbb500e2a2f109494eb65f53a133a8a09e62c9584a8a45d73d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 318bc669d7b4a1bbb500e2a2f109494eb65f53a133a8a09e62c9584a8a45d73d
SHA3-384 hash: 469a9a889e84cd4dbe48cea014fae99d3c57cd1b3734f0ab86e31508fa34c4cb068bb381e022665d5fc5c5a9c4071200
SHA1 hash: 058f2d635bdcb8b44f395bd1fba6991a76ca72e4
MD5 hash: 90c0a7145db568579911880f838cf7de
humanhash: juliet-artist-sad-nineteen
File name:Marcelo New Order_pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:276'850 bytes
First seen:2020-10-05 05:21:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Ty5QILp9E4rae+t9uryNPIgNEn5r/Ng2Hw0hs37wJuteHWMmg2W0o2:TynLHE4r3Ws6DNCRsrwJzPmg2z
TLSH 894423B8B1A3F1B272115BE47E06E15E9AF387FA1811FEEC9A7F1C27E1014543D0189A
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Marcelo Prieto< Marcelo@521.mulxi.ml>"
Received: "from dfl0.521.mulxi.ml (unknown [134.122.44.251]) "
Date: "04 Oct 2020 16:11:08 -0700"
Subject: "Marcelo New Order Inquiry "
Attachment: "Marcelo New Order_pdf.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/318bc669d7b4a1bbb500e2a2f109494eb65f53a133a8a09e62c9584a8a45d73d/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-04 21:57:17 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ggf4m2oxwsq3xnia4krpcckjj23f6u5bgoukbhtczfmevcsf246q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/318bc669d7b4a1bbb500e2a2f109494eb65f53a133a8a09e62c9584a8a45d73d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 318bc669d7b4a1bbb500e2a2f109494eb65f53a133a8a09e62c9584a8a45d73d

(this sample)

AgentTesla

Executable exe 73f6286bd85316cb72796f461e1ad724b8434837f1a10a4a625862c3a7e3c173

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 73f6286bd85316cb72796f461e1ad724b8434837f1a10a4a625862c3a7e3c173

Comments