MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3c604196f9c29656f826a5a48e558e62995fb9ff38690e2c11f68163ea5ff49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f3c604196f9c29656f826a5a48e558e62995fb9ff38690e2c11f68163ea5ff49
SHA3-384 hash: da85d399e4f3788179554f4900026db5446e0d78068da90bccc3c3fa322bcc4d3128319e6d9181e5d79fc41339768484
SHA1 hash: 463d4e63647634ff52851e73dce43b89de33e55d
MD5 hash: 324f8eb2fa3116ea71ac45e1f26a7bad
humanhash: nebraska-solar-three-mississippi
File name:new�order.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:495'790 bytes
First seen:2020-09-05 12:27:31 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:3WcrBvNca/0C/5psOls6AM1zBSyT72/OoWyrIT5nmvs6IJfqvq5ZE:rrBNca8C/5ScQszUyT72JWyrwZOsXJST
TLSH 71B423193B62A9793C096EF18EA4D44475ECFD7639C0E0A7BEACC32F844D60275C66C2
Reporter cocaman
Tags:AgentTesla z


Avatar
cocaman
Malicious email
From: Amirah<Amirah@fr.bureauveritas.com>
Received: from fr.bureauveritas.com (unknown [95.211.253.201])
Date: 5 Sep 2020 08:54:33 -0700
Subject: Re: PURCHASE ORDER KBPO-000074_Rev1
Attachment: new�order.pdf.z

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f3c604196f9c29656f826a5a48e558e62995fb9ff38690e2c11f68163ea5ff49/
Threat name:
Win32.Trojan.LokibotCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-09-04 23:05:47 UTC
File Type:
Binary (Archive)
Extracted files:
40
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6pdaiglptquwk34cnjnerzky4yuzl6476odjbywbd5ubmpvf75eq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f3c604196f9c29656f826a5a48e558e62995fb9ff38690e2c11f68163ea5ff49

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z f3c604196f9c29656f826a5a48e558e62995fb9ff38690e2c11f68163ea5ff49

(this sample)

AgentTesla

Executable exe 3117dd759398a481d1664d1731ebc73fe140ac04e711b19a8a8bb6a22d607f3d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3117dd759398a481d1664d1731ebc73fe140ac04e711b19a8a8bb6a22d607f3d
  
Dropping
AgentTesla

Comments