MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72ecf1c51fc48bcd27b7c1a97ad7a0242419cda53e57c27a51f57071fad7759b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72ecf1c51fc48bcd27b7c1a97ad7a0242419cda53e57c27a51f57071fad7759b
SHA3-384 hash: 15eba796487fd3eadc6c20c3f09040a05bbb8ad4ed47063d1b64ff95aa19b1b2a2d4b6091f108c9a6aa6a9aeb4517b45
SHA1 hash: 077ba0a7799d5f8fbd272774e17dc3bf4b53afaf
MD5 hash: 77a155962d3868adb348ec8db9a33e48
humanhash: earth-speaker-mars-iowa
File name:Purchase Order-00880033008025052020.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:251'774 bytes
First seen:2020-05-25 12:12:48 UTC
Last seen:2020-05-25 13:24:52 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:liLYaIGe4+kZAMwzGDLPlv5A4/d9ZKjwM/:liLNeiAMwzes4/LZK8W
TLSH 4734235E04324A7B5291B2D701A53C3B66992A357F3E1BAE0AFD9E31001CF1F49E5EB1
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email
From: "David Ozer" <david@sitco-intl.co>
Received: from box.sitco-intl.co (box.sitco-intl.co [128.199.35.122])
Date: Mon, 25 May 2020 05:08:39 -0700
Subject: fwd: Purchase Order-00880033008025052020
Attachment: Purchase Order-00880033008025052020.rar

Intelligence

File Origin
# of uploads :
2
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Npe
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 12:37:03 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
18 of 48 (37.50%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 72ecf1c51fc48bcd27b7c1a97ad7a0242419cda53e57c27a51f57071fad7759b

(this sample)

AgentTesla

Executable exe 9d2a8b10360c33870703b79c4b9a102b3881b9d903870f5f9863c5e61e1c132c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9d2a8b10360c33870703b79c4b9a102b3881b9d903870f5f9863c5e61e1c132c

Comments