MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3e96bbf1882a6862dff4e3674ce120bcece3eb570391934b72d2fc7b4a4a0f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f3e96bbf1882a6862dff4e3674ce120bcece3eb570391934b72d2fc7b4a4a0f5
SHA3-384 hash: b938653a8429b8875438354de1c380c3c7fc22218ccfa931fc58ef3b47f19231ce7cd5d859bef96321191a31618680df
SHA1 hash: e556211f559c1e7d4f4cf39bfaabbe789bf8c458
MD5 hash: 9a75d5fcab6b0b1f895e54486d2e2168
humanhash: lactose-arkansas-violet-earth
File name:Packing List.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:545'936 bytes
First seen:2021-03-11 06:15:21 UTC
Last seen:2021-03-11 06:24:11 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:OxYVfBdBhsvuiQCQR2EEwbNAMVd5a0ICmA0SFBfT4K:y8dkW0QdEwbVs0IBARTB
TLSH 4DC423EEB940C640CF9DFE99E78F8E02784457E96EDBB962B79CE16816E310E3014711
Reporter cocaman
Tags:AgentTesla INVOICE rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Agace Kazim<info@woodencrates.org>" (likely spoofed)
Received: "from woodencrates.org (unknown [103.151.125.78]) "
Date: "10 Mar 2021 13:55:37 -0800"
Subject: "AW:AW:AW: INVOICE"
Attachment: "Commercial INV.rar"

Intelligence

File Origin
# of uploads :
7
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f3e96bbf1882a6862dff4e3674ce120bcece3eb570391934b72d2fc7b4a4a0f5/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-10 16:30:18 UTC
File Type:
Binary (Archive)
Extracted files:
114
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6puwxpyyqktimlp7jy3hjtqsbphm4pvvoa4rsnfxfux4pnfeud2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/f3e96bbf1882a6862dff4e3674ce120bcece3eb570391934b72d2fc7b4a4a0f5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f3e96bbf1882a6862dff4e3674ce120bcece3eb570391934b72d2fc7b4a4a0f5

(this sample)

AgentTesla

Executable exe e788267bd465398845c78b8aed7eba1a9b32c5907ea1660e41e1b5f6286e6cab

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e788267bd465398845c78b8aed7eba1a9b32c5907ea1660e41e1b5f6286e6cab
  
Dropping
AgentTesla

Comments