MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b11138c6b533a481af4c78d36b639d71830f9f92e8a683e1ef7be7cc40bc87c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b11138c6b533a481af4c78d36b639d71830f9f92e8a683e1ef7be7cc40bc87c
SHA3-384 hash: 486cef6be882cc095d590125957c18693e051533f4e5bd49926f4f170814c9608ef22de6d57f3a385ef96878cac1c27e
SHA1 hash: 7f03c3e83a26474733b34d3193e8d8e268ad8991
MD5 hash: 32393c94a10448be6215aaeaa7a3f503
humanhash: zulu-skylark-ten-friend
File name:General_docBLINVAWBPL.pdf.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:424'435 bytes
First seen:2020-06-17 05:52:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:VLSkjoRrgzJ1CQA3Je2EsrO+Oq62SgFoo76M5ozxoPL8E9DzafKfFYHJax:VSk0RyJ1CQA5emF6EoJMytuafKOHIx
TLSH 8794232A858462F056EF4E939AB809A7CD97FF10DD57FA13E36B3140E27531C3A93089
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: host.iteamweb.com
Sending IP: 209.59.138.164
From: Jenny Lee <jennylee1@scspro.co.kr>
Subject: Final Shipment documents/ STATUS + Arrival Notice
Attachment: General_docBLINVAWBPL.pdf.arj (contains "General_docBLINVAWBPLpdf.exe")

AgentTesla SMTP exfil server:
secure231.servconfig.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Generic.fc.30295.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 05:54:06 UTC
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hmirhddlkm5eqgxuy6gtnnrz24mdb6pzf2fgqpq6667hzralzb6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3b11138c6b533a481af4c78d36b639d71830f9f92e8a683e1ef7be7cc40bc87c

(this sample)

AgentTesla

Executable exe 356c699175a1c80f88272c54c40bcee13db731bdd78674ec0687fa164db51943

  
Dropping
MD5 24bd5a65922648417e87eb8d77e325bd
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 356c699175a1c80f88272c54c40bcee13db731bdd78674ec0687fa164db51943

Comments