MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3fb785e98809c6c4ea0ca8cb576c0603edfda221ba32a9dedb46cb91c663fd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f3fb785e98809c6c4ea0ca8cb576c0603edfda221ba32a9dedb46cb91c663fd4
SHA3-384 hash: 01f8b3a583faffd0e00934227bc580cd90b6964a68ca1edd94f95f74488d5adf7615da072811e9c517a5f55b6cbc4a2d
SHA1 hash: 99fbfa980c559b0ef8d0e276455285831516f371
MD5 hash: f87b1ced1496376574576269b8b9d62e
humanhash: single-snake-black-butter
File name:purchase order.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:562'643 bytes
First seen:2020-09-24 11:09:42 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:BIvE1bHrNU8/Kv2q6TfCxR4dDImNrZlext1d/kmOUgs2UBnQTP8b/nf:3bLNPpQgDImNrZla1imONDWQT0b/f
TLSH EAC423831A23604AF439D4B568B2BEE0A6DCD1E0B7D1D4CD8175EE037A4DBC98D783A5
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Kinuthia Erastus <ekinuthia@tropikal.co.ke>"
Received: "from tropikal.co.ke (unknown [103.151.124.245]) "
Date: "24 Sep 2020 04:09:11 -0700"
Subject: "Re: Tropikal september order"
Attachment: "purchase order.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f3fb785e98809c6c4ea0ca8cb576c0603edfda221ba32a9dedb46cb91c663fd4/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2020-09-24 02:57:26 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6p5xqxuyqcogytvazkglk5wama7n7wrcdorsvhpnwrwlshdgh7ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f3fb785e98809c6c4ea0ca8cb576c0603edfda221ba32a9dedb46cb91c663fd4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f3fb785e98809c6c4ea0ca8cb576c0603edfda221ba32a9dedb46cb91c663fd4

(this sample)

AgentTesla

Executable exe ae98cbea751b110688b554259e94536ad47799d68af23f5c499f0021c09861b0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ae98cbea751b110688b554259e94536ad47799d68af23f5c499f0021c09861b0
  
Dropping
AgentTesla

Comments