MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b557cc324011048ff9db04544028a9679e1853981e60b35f344a48f5a75d7ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b557cc324011048ff9db04544028a9679e1853981e60b35f344a48f5a75d7ad
SHA3-384 hash: 3c8021681b8972211c00fcfb3d18fb35573c3588bf69d4294c0cbdb447c0dc139abffcca4dc6c208e019a6c382428ead
SHA1 hash: 1edbd52fcb4fe4e304301e536d07526d167dbfb3
MD5 hash: aef794ce06c59a8964d536ee93bf77cf
humanhash: paris-sodium-louisiana-sixteen
File name:Pictures,Designs,Invoices,40ft containers.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'417'354 bytes
First seen:2020-07-06 14:35:40 UTC
Last seen:2020-07-21 14:33:36 UTC
File type: z
MIME type:application/x-rar
ssdeep 24576:HvKslGxmFScj7QZNN+CZhygYHXCW/QomRcCgOs+OaeFQpUDG05qPKCQP3fdZRpk:PKlxFKQvDyHXCW/QPRISOaeFY0g5k3fU
TLSH C3653365DF2F136EB143963E25BA1A463C5D939F017DE2A102BF943842B6C3B8E423D5
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.fundscript.xyz
Sending IP: 45.95.169.179
From: info@fundscript.xyz
Reply-To: info@fundscript.xyz
Subject: About Shipments
Attachment: Pictures,Designs,Invoices,40ft containers.z (contains "Invoice 205675.exe")

AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b557cc324011048ff9db04544028a9679e1853981e60b35f344a48f5a75d7ad/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 14:37:04 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hnkxzqzeaeier745wbcuiauksz46dbjzqhtawnptissi6wtv26wq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 3b557cc324011048ff9db04544028a9679e1853981e60b35f344a48f5a75d7ad

(this sample)

AgentTesla

Executable exe eb4a1e0dfb62e335b264c6b244619683a8e0decf3ddb9d4c0b0fee8b7dff23d0

  
Dropping
MD5 f6e48f2b5af6b9aa05e49c6d56e7b1c9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eb4a1e0dfb62e335b264c6b244619683a8e0decf3ddb9d4c0b0fee8b7dff23d0

Comments