MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b9a5cc3455c7dcd9bf22edb4e989661098025623b865621e9a4b41cd719150b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b9a5cc3455c7dcd9bf22edb4e989661098025623b865621e9a4b41cd719150b
SHA3-384 hash: d41a50db791544a2e946bbe4d93e518d894e68ad5379599779b61f54d4b428b9c26b91e2f081ccc5a941b933a3b218a2
SHA1 hash: b1fcbe863843b616366f69a5b155532def53a384
MD5 hash: 6d3991f468022150509d459276e4e429
humanhash: nebraska-rugby-alpha-double
File name:Pallex PO A0147197_ITALY.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:435'761 bytes
First seen:2020-05-26 12:53:36 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:G2B2nTSVgF51jV6myToAIul5aOXIjYXKpZgO:1InuV+63XI6wO4UYP
TLSH 429423DC455DA3AEF3D3E9826771C54CD8D44BC7120EC03A2882A9398FD456AB609FF9
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: zimbra207.megavelocity.net
Sending IP: 192.206.6.182
From: zafar.i@budget1.net
Subject: Pallex PO A0147197_ITALY
Attachment: Pallex PO A0147197_ITALY.rar (contains "Order_4488577_list.doc.exe")

AgentTesla SMTP exfil server:
premium57.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27215.RarHeur.nocdb.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 13:36:22 UTC
AV detection:
17 of 30 (56.67%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 3b9a5cc3455c7dcd9bf22edb4e989661098025623b865621e9a4b41cd719150b

(this sample)

AgentTesla

Executable exe e2ee107b59612c9ca7bc1df9d460f3c7205503aaa92346bcab201cb7c153f25a

  
Dropping
MD5 3089c7102435d9700d73ef949b43f634
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e2ee107b59612c9ca7bc1df9d460f3c7205503aaa92346bcab201cb7c153f25a

Comments