MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 385dec0df902abbe0a23d1711ba8ceac1885d102ad34a3f8f29573c44553077e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 385dec0df902abbe0a23d1711ba8ceac1885d102ad34a3f8f29573c44553077e
SHA3-384 hash: 661c07f5fd3a0f9ce80d9e27b6827fabad0f6c60120d9d6dcc9a73eaa4593dd089f4087597f781855f9501e2d4e25e63
SHA1 hash: 2c657cbbd37b8125ad4167bb4bf74c693123f5aa
MD5 hash: ee151b3b8aa35c3c041a458f65e062f1
humanhash: jig-hamper-mirror-salami
File name:DOCUMENT.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:460'327 bytes
First seen:2020-09-07 08:19:40 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:aaS8PYbaY5EsWenRacLroreWuprs1LHBUZBxkBBMk:aahYEgL8rNp1aB+h
TLSH E2A423FEA7C885CB9D2C40334F2E12135F5B6112A3EB2ECACC1055B48F559B1A9697A3
Reporter cocaman
Tags:AgentTesla z


Avatar
cocaman
Malicious email
From: Dispatch Department<Fred@weidmueller.com>
Received: from weidmueller.com (unknown [95.211.253.201])
Date: 7 Sep 2020 08:16:11 -0700
Subject: =?UTF-8?B?UmU6IEZZSeKApkRPQ1VNRU5U?=
Attachment: DOCUMENT.pdf.z

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/385dec0df902abbe0a23d1711ba8ceac1885d102ad34a3f8f29573c44553077e/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-09-06 21:16:05 UTC
AV detection:
15 of 47 (31.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hbo6ydpzakv34crd2fyrxkgovqmiluicvu2kh6hssvz4irkta57a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/385dec0df902abbe0a23d1711ba8ceac1885d102ad34a3f8f29573c44553077e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 385dec0df902abbe0a23d1711ba8ceac1885d102ad34a3f8f29573c44553077e

(this sample)

AgentTesla

Executable exe d6ade904fb2225703807124276b3c9f8eeeb737d7f44aacc82eb63eee77cfa5d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d6ade904fb2225703807124276b3c9f8eeeb737d7f44aacc82eb63eee77cfa5d
  
Dropping
AgentTesla

Comments