MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3976e95d0a418f7c78982799743a4ea6ec94127a4a788e32b4c321a06cf05721. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3976e95d0a418f7c78982799743a4ea6ec94127a4a788e32b4c321a06cf05721
SHA3-384 hash: 978d74ffdf361dcae52590b62739a46d5baddc7be597c1626c5a0128ef97aa069ac0893cdbcdd3dae0b062c89c2d66a3
SHA1 hash: 791b3a53587b693a9e2ed2346823cfad8cee4cc0
MD5 hash: c2a8fb57470a48f1ea2a9d2a50e39afe
humanhash: fifteen-wisconsin-north-burger
File name:DOC030520-0~.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:695'012 bytes
First seen:2020-06-05 06:06:46 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:Idnr5CkoiZ1VQCeJDcx+ZHI1Sw9zpOTGG95jDKbnE6cVlw1Wt6WOe4p2Yx:Idr5CjiFuDcIH2SEMTGGTDwBR0t6Wc
TLSH EAE4336861ED78979DE9533B5ACCE1926AE34F630E394608FC2527E2C06F04921FB537
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: serve0.barunka.pw
Sending IP: 173.82.94.231
From: Nahm Gil-Hyun <wgd20091001@163.com>
Subject: [NEW ORDER] PO TRD20026 // CHOYANG TRADING
Attachment: DOC030520-0~.7z (contains "DOC030520-0~.exe")

AgentTesla SMTP exfil server:
smtp.pbrend.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 01:21:00 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hf3osxikighxy6eye6mxiosou3wjiet2jj4i4mvuymq2a3hqk4qq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 3976e95d0a418f7c78982799743a4ea6ec94127a4a788e32b4c321a06cf05721

(this sample)

AgentTesla

Executable exe 8b029f16ada90435e49b9e418b20ada1da70b00faf95e7c1d42a82c35a791bea

  
Dropping
MD5 de23f4384202baf1211b1fb83dbe7a5a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8b029f16ada90435e49b9e418b20ada1da70b00faf95e7c1d42a82c35a791bea

Comments