MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3a572084e9eb99d9ed6bb2172e08e18c696341a1181a91b02b5969cc2aaaa71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3a572084e9eb99d9ed6bb2172e08e18c696341a1181a91b02b5969cc2aaaa71
SHA3-384 hash: 3a2baffd029b76010d9bb2a91e66b8f267d4e9d9ada5f2e2f46be65d6b629a787d5bd4ef647b2e133edfe056bf8644a9
SHA1 hash: 96539fb12b20b48ef54e04f6c3a056f91ca8f582
MD5 hash: a6b42db9e471660b49e4c5e9e7fc849e
humanhash: wisconsin-summer-helium-autumn
File name:No 91120116725.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:602'102 bytes
First seen:2020-12-03 07:06:09 UTC
Last seen:2020-12-03 07:06:57 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:bYJjuERYgL8KhMwjnEz7BsewWw+aTTjikgaqDAVsKnQis0Nl6:bquERYE6wjnEBsxDjqkVsuQN0b6
TLSH CBD423EC40F660231AE60BCA666796FE0EDCDEE491B78CDD0E342741A96B1EC5E44CC5
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Hemanth Karthick"<docs@lom-logistics.com>" (likely spoofed)
Received: "from lom-logistics.com (unknown [103.99.1.174]) "
Date: "2 Dec 2020 13:30:32 -0800"
Subject: "NEW ORDER: New freight forwarding in Qingdao branch (DMC IMPORT CARGO)"
Attachment: "No 91120116725.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d3a572084e9eb99d9ed6bb2172e08e18c696341a1181a91b02b5969cc2aaaa71/
Threat name:
ByteCode-MSIL.Trojan.Sudloader
Create hunting rule
Status:
Malicious
First seen:
2020-12-03 07:07:05 UTC
File Type:
Binary (Archive)
Extracted files:
29
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2osxeccot24z3hwwxmqxfyeodddjmna2cga2sgycwwljzqvkvjyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d3a572084e9eb99d9ed6bb2172e08e18c696341a1181a91b02b5969cc2aaaa71

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d3a572084e9eb99d9ed6bb2172e08e18c696341a1181a91b02b5969cc2aaaa71

(this sample)

AgentTesla

Executable exe 5cb6068ff35f15f9403ecb538348ded12e2630a1033a5e631ee503726e9a0786

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5cb6068ff35f15f9403ecb538348ded12e2630a1033a5e631ee503726e9a0786
  
Dropping
AgentTesla

Comments