MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c5c160f6499958befccfd086fa9636d047bef057c95195d606b51a86832a7d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c5c160f6499958befccfd086fa9636d047bef057c95195d606b51a86832a7d6
SHA3-384 hash: c3bb1f85aac9ea89dad1dd81fe61b4bdf2faa59db6aeef253b6a37b49327e0a5cf1bf7799948373c1e6d03e4033b3c0c
SHA1 hash: d18419c185715f3c5a10d14c0700f9ecbc469cf7
MD5 hash: ae3a5cbde8ba646260fd10b579d6f901
humanhash: nevada-california-east-tango
File name:POList Order == Xls.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'229'511 bytes
First seen:2021-04-07 06:00:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 49152:4VoO+bPF885V+tAcXL2bxiqXLH15wrUUc43RfU2oyf+Mpy07CzhaEtsdZ4/N8D9t:bbPCQV0AIKA8LH1wFdR82BWMcThaEGd3
TLSH 68A533949CCB1506D5E46CE5932490D09E6FDE220C9B0AD73229DE18249CA495FEDFCB
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: joinw3.com
Sending IP: 172.105.43.124
From: Aditya Goel<apex.labs@apex.labs.com.in>
Subject: Re: PO List Order == Xls
Attachment: POList Order == Xls.zip (contains "POList Order == Xls.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_xls.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/3c5c160f6499958befccfd086fa9636d047bef057c95195d606b51a86832a7d6
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3c5c160f6499958befccfd086fa9636d047bef057c95195d606b51a86832a7d6/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 06:01:22 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hrobmd3etgkyx36m7ueg7kldnuchx3yfpskrsxlanni2q2bsu7la._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3c5c160f6499958befccfd086fa9636d047bef057c95195d606b51a86832a7d6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3c5c160f6499958befccfd086fa9636d047bef057c95195d606b51a86832a7d6

(this sample)

AgentTesla

Executable exe ec09579076428b4e788722563b4b768eb0e9f8c75d70aa3cd5d9866a40ebd171

  
Dropping
MD5 b491ee3c9752d540244c24de39aa2690
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ec09579076428b4e788722563b4b768eb0e9f8c75d70aa3cd5d9866a40ebd171

Comments