MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d1d3c576e778ffa4f35de33693c32e6802f2a362ec953efaa2ed6c02c7052e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d1d3c576e778ffa4f35de33693c32e6802f2a362ec953efaa2ed6c02c7052e5
SHA3-384 hash: 307c859769164f22f801892b2191fb28836940f6f76c85c2b4257b82e71524b301964354c5e5a07ef38fef5747e06a28
SHA1 hash: 8f4033702060da3a3bd17c16550adc04e0ca7851
MD5 hash: a6e823a5b373c89d5b5a0dc239b56bd9
humanhash: coffee-black-uranus-lima
File name:Invoice0978.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-16 19:19:00 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:BvY2k4zUEBRf8Y0dWvfRNBNaaxwjPZbSTn:BJBREY0SR9RQ
TLSH AD45F0CC2E649611DA9C4EB80DA1D53012706E66F8F5F24837CDFF8F3B36215EA46A25
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: powertr@cyber.net.pk
Subject: Proforma Invoice
Attachment: Invoice0978.img (contains "1nkjH2Sua25O2db.exe")

AgentTesla FTP exfil server:
triathlon-batteries-uk.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.21884.27055.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d1d3c576e778ffa4f35de33693c32e6802f2a362ec953efaa2ed6c02c7052e5/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-07-16 19:20:10 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=huotyv3oo6h7utzv3yzwspbs42ac6krwf3evh35kf3lmaldqklsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 3d1d3c576e778ffa4f35de33693c32e6802f2a362ec953efaa2ed6c02c7052e5

(this sample)

AgentTesla

Executable exe 56db6f69bbc36e0758d7e5e1cce28ddc57f3eec355a36c1b9170d509780a4c2e

  
Dropping
MD5 627579f1dcbc328a55c2fce2aee91a73
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 56db6f69bbc36e0758d7e5e1cce28ddc57f3eec355a36c1b9170d509780a4c2e

Comments