MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ac6718fd3f723512a64393699533288be87e9866aaf278c36290e6bc0064c72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ac6718fd3f723512a64393699533288be87e9866aaf278c36290e6bc0064c72
SHA3-384 hash: 116eaf38034faa30b0258d44620e382c8c80913da63cac8a1559c50ccbb7989c4c64dd0a9ca0d1d5015df9134839e78e
SHA1 hash: 510b62aab0e6f92820a5ad68776bd5ef57f7286b
MD5 hash: f716645bc103a90268fff9660cbee528
humanhash: glucose-delaware-east-mango
File name:45678765456.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:431'177 bytes
First seen:2020-05-01 12:23:41 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:91G2upXswu0+iUDk+D2e4Rz4qdcCZyqy2pn4:a2upXE01UDkukB4qCV2B4
TLSH C894231F41FA8D1C7BDFE19C481A30E84DE61AE93564609BEB7FA21E042353938644FB
Reporter abuse_ch
Tags:AgentTesla ESP geo gz Santander


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.qrodi.com
Sending IP: 45.95.168.60
From: Factoring y Confirming - Grupo Santander <fycuot@gruposantander.com>
Subject: Confirming - Aviso de pago
Attachment: 45678765456.gz (contains "45678765456.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:25

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 12:35:45 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hldhdd6t64rvcktehe3jsuzsrc7ip2mgnkxspdbwfehgxqagjrza._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 3ac6718fd3f723512a64393699533288be87e9866aaf278c36290e6bc0064c72

(this sample)

AgentTesla

Executable exe 7843d0972708f2654bbcff592faf5dc9080cf8d141ed3f72826adbdbfc7dec2b

  
Dropping
MD5 afc24a73e57da8cb7abfc2ad6202ba45
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7843d0972708f2654bbcff592faf5dc9080cf8d141ed3f72826adbdbfc7dec2b

Comments