MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3bb09c56522a13ee6a00826c42eb3b583e17cbd3c97cca04918905d32f056dd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3bb09c56522a13ee6a00826c42eb3b583e17cbd3c97cca04918905d32f056dd6
SHA3-384 hash: 013b1c51c58f60a9043dd8ad298c744f4d962b536e4124608d0e1abd7dee6f1880fd0d471e5506a03305f5c2bc0c5901
SHA1 hash: 32fcfeccb871cec77e70a8ffaaa3f6705323fb35
MD5 hash: 028d32dd580fc396d59b375b40b8250d
humanhash: shade-foxtrot-florida-hotel
File name:RFQQHE20-0436.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'393'050 bytes
First seen:2020-05-08 07:12:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:D4K3detkavlS0vhQP/Gb9NmeUOoR4LUnZAFQpStzOJLZ84ukxHPFne64Mx4e4Lys:DV3dudDMMEOfLUZACpIOJLZ8MvFn/Mys
TLSH F45533D7FB390FDBEC70A2535CDA2AE05775429EE49C20319E7162272C0D2961B3BE94
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: rdns0.dhanrajplasticss.com
Sending IP: 5.253.86.61
From: "Nga Le | Inavate" <purchasing@inavate-av.com>
Subject: [Ext] QUOTATION (QHE20-0436)
Attachment: RFQQHE20-0436.pdf.gz (contains "RFQ#QHE20-0436.pdf.exe.exe")

AgentTesla SMTP exfil server:
mail.hajartrading.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Adware.Generic4.AANW.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.17924.zip.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Hploki
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 07:36:07 UTC
File Type:
Binary (Archive)
Extracted files:
65
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hoyjyvssfij642qaqjwef2z3la7bps6tzf6muberrec5glyfnxla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3bb09c56522a13ee6a00826c42eb3b583e17cbd3c97cca04918905d32f056dd6

(this sample)

AgentTesla

Executable exe f2db78e5165646f19a5b9438764740b24ab4c578890cd68e292cedaed3f7ca84

  
Dropping
MD5 5583cbebfa85750b185b35b0080ce3bc
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f2db78e5165646f19a5b9438764740b24ab4c578890cd68e292cedaed3f7ca84

Comments