MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38d75a21d9d8244dd88e2aedc1e07e7f233ab4262c754218632d0e90f8743e66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38d75a21d9d8244dd88e2aedc1e07e7f233ab4262c754218632d0e90f8743e66
SHA3-384 hash: 51bdb83f8e7aea7f973218a8e20511bbd8ab299ef4d12d5e33193e51558c586a153f2cad5b9b11b230a174db8852de35
SHA1 hash: d74b4fb8f2a974547dfec4bdf85b3a9f25efa5fa
MD5 hash: 600a35f17158005d110ea76d5fd66225
humanhash: yankee-pluto-mexico-alpha
File name:Scanned Copy.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:441'834 bytes
First seen:2021-03-05 12:02:42 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:vWNL0bbNPtTT96IuLCThDEo9ZxvFH2UnmwlH3eQ73V0vA617XGy17UjCh4Rwdd43:iuxFH96I6ahgUZnFV3t50L6Tuh6hEO/
TLSH 4D9423C08C0AB92C49DBCC57DD12C427489A7EA9990BD0CDB6349D1E7F6DB71E1E0C66
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Frank<salesdesk@eis-inc.com>" (likely spoofed)
Received: "from [203.159.80.7] (unknown [203.159.80.7]) "
Date: "5 Mar 2021 13:01:50 +0100"
Subject: "Scanned Copy"
Attachment: "Scanned Copy.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/38d75a21d9d8244dd88e2aedc1e07e7f233ab4262c754218632d0e90f8743e66/
Threat name:
ByteCode-MSIL.Trojan.Malrep
Create hunting rule
Status:
Malicious
First seen:
2021-03-05 12:03:06 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hdlvuioz3ase3weoflw4dyd6p4rtvnbgfr2uegddfuhjb6duhzta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/38d75a21d9d8244dd88e2aedc1e07e7f233ab4262c754218632d0e90f8743e66

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 38d75a21d9d8244dd88e2aedc1e07e7f233ab4262c754218632d0e90f8743e66

(this sample)

AgentTesla

Executable exe e8ce41acaa06e08bc891d3919aa8dc5ab8529093bbd893960a60a5c093bd649a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e8ce41acaa06e08bc891d3919aa8dc5ab8529093bbd893960a60a5c093bd649a
  
Dropping
AgentTesla

Comments