MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b3227148a76cebba26528fcca582241c63a8523e2655426f6a276ad625fb41f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b3227148a76cebba26528fcca582241c63a8523e2655426f6a276ad625fb41f
SHA3-384 hash: 38037e82c611403b8e3cfb45fc389203a8fb67dfc9df161e0d6c444bf170d95026461f49f633e161d4067e60a834e2fd
SHA1 hash: 4f87db131680dd29e43ae49db876f39f07225de4
MD5 hash: a7911c19a678ed0edea11effb5df62e7
humanhash: alaska-twelve-pip-bluebird
File name:PO NOAB1088 ALEMO INDUSTRIAL ENGINEERS.exe.bz2
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'034'610 bytes
First seen:2021-07-29 11:42:52 UTC
Last seen:Never
File type:
MIME type:application/x-bzip2
ssdeep 24576:gZw/nQpszAlK7FYIftGHwkd9pcAgBjQoRDSBsbeadTzJ:gZw46YfIVGQkd0BjQosod
TLSH T1C12523E1319F4B6BB91A5FBEA48D591866ECD43187306CC015F41ACDE5C8EC18E7CBA8
Reporter cocaman
Tags:AgentTesla bz2


Avatar
cocaman
Malicious email (T1566.001)
From: ""Mr. VIKAS C E" <EXPRESS_ADG@ismarine.com.tr>" (likely spoofed)
Received: "from ismarine.com.tr (unknown [45.137.22.38]) "
Date: "29 Jul 2021 11:09:24 +0200"
Subject: "PO NO:AB1088 // ALEMO INDUSTRIAL ENGINEERS"
Attachment: "PO NOAB1088 ALEMO INDUSTRIAL ENGINEERS.exe.bz2"

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20210729-1007.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-29 11:43:09 UTC
File Type:
Binary (Archive)
Extracted files:
53
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rmzcofeko3hlxitffd6muwbcihddvbjd4jsvijxwuj3k2ys7wqpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8b3227148a76cebba26528fcca582241c63a8523e2655426f6a276ad625fb41f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

8b3227148a76cebba26528fcca582241c63a8523e2655426f6a276ad625fb41f

(this sample)

AgentTesla

Executable exe e13c26e3f597f9408603d053ee4e246995adf0973b96f7d0eabfadc9d63d52c3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e13c26e3f597f9408603d053ee4e246995adf0973b96f7d0eabfadc9d63d52c3

Comments