MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ad683d8038d334634baf46a1452cde3116f5804d881b9ad33cebaf4704b5c9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	3ad683d8038d334634baf46a1452cde3116f5804d881b9ad33cebaf4704b5c9e
SHA3-384 hash:	cf5842c905b83d2f8a9459d272a4707e88624cd8a79f4521af0f3ac7e17c194f211917c3fd019bf109da91aaa0f4e97a
SHA1 hash:	3189c11556403c228b961c8e70b04679f10786f7
MD5 hash:	912f6f8b8724e3800a0001cf7cc771ef
humanhash:	four-leopard-kansas-florida
File name:	Shipment Advice & Draft BL.zip
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	705'461 bytes
First seen:	2023-07-13 08:15:26 UTC
Last seen:	2023-07-13 08:17:18 UTC
File type:	zip
MIME type:	application/zip
ssdeep	12288:PEloZBSztJp9K2WxPKsz9Q4Mj7dbJC+jvPwO6PGsKgxKrmHlx+Zyluz9B5RsDJ6M:cloQtz9+xpzeJZvIO05E8lx+IlkBI7dB
TLSH	T177E433AAB15E34D87368D1BBD3CCBF49F4B71C30B7F8589A4EB01364D06508997229B9
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	AgentTesla zip

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Shipment Advice & Draft BL.exe
File size:	882'176 bytes
SHA256 hash:	7d4d2a289195f4c5ea91de699999037acd8f969b9c562531234c3ff0faedcb2a
MD5 hash:	9505a5a4947bff428749a29813e4caf8
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.27433.17344.UNOFFICIAL

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/3ad683d8038d334634baf46a1452cde3116f5804d881b9ad33cebaf4704b5c9e/results/dashboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/64afb2c657d1eb6a904f6722/reports/79ee8f5d-e879-4c1e-ad55-9ae1df0172ed/overview

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/3ad683d8038d334634baf46a1452cde3116f5804d881b9ad33cebaf4704b5c9e

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/3ad683d8038d334634baf46a1452cde3116f5804d881b9ad33cebaf4704b5c9e

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3ad683d8038d334634baf46a1452cde3116f5804d881b9ad33cebaf4704b5c9e/

Threat name:

ByteCode-MSIL.Trojan.Zmutzy

Status:

Malicious

First seen:

2023-07-13 03:12:26 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

13 of 38 (34.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hllihwadruzumnf26rvbiuwn4miw6wae3ca3tljtz25pi4cllspa._file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.