MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e30c45953e8fdaeb6be651c4257e18882553f002cc2b85899ba5b55f25b8dab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e30c45953e8fdaeb6be651c4257e18882553f002cc2b85899ba5b55f25b8dab
SHA3-384 hash: 59e65ac1207bedcb89d408e694f3055ae6b17648c5e86bcad5542b7a02bd9c47d2b879c7b13d6306c639feac32dd6d32
SHA1 hash: 5b571757e35a5bcacf2ac0db0dfef5ce7af8f912
MD5 hash: a923c220cb07584d0f2a51c8349dc2b8
humanhash: lithium-august-undress-ohio
File name:Scan copy.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:570'536 bytes
First seen:2021-02-15 06:43:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:NDMVTJfaw0h4jcv0MKp72SaBhsctOwoUJvSkGWP9jZy+TZynGp0ZwA:wdCFCcv0MKp9av+Vk7P9h1/jA
TLSH A1C423A46E3B69B8BE890E214515F848A048DDC7D77F0482A136EE68FCC24DED755EE0
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Jack Wang <purchase8@pungkookvn.com>" (likely spoofed)
Received: "from ns2.extraweb.az (ns2.extraweb.az [94.20.21.50]) "
Date: "Mon, 15 Feb 2021 09:31:31 +0400"
Subject: "Re: Order Confirmation / Quotation."
Attachment: "Scan copy.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e30c45953e8fdaeb6be651c4257e18882553f002cc2b85899ba5b55f25b8dab/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-15 06:44:10 UTC
File Type:
Binary (Archive)
Extracted files:
35
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hyymiwkt5d625nv6muoeev7brcbfkpyaftblqwezxjnvl4s3rwvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3e30c45953e8fdaeb6be651c4257e18882553f002cc2b85899ba5b55f25b8dab

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 3e30c45953e8fdaeb6be651c4257e18882553f002cc2b85899ba5b55f25b8dab

(this sample)

AgentTesla

Executable exe 8f128126322df89a84daeff6e86a4b50345505cd5ac83cde439a810c482ae9e5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8f128126322df89a84daeff6e86a4b50345505cd5ac83cde439a810c482ae9e5

Comments