MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3dd96ef11b271f5663cfff4634b4bad5e46017b076dcc8738966478d4065ac3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3dd96ef11b271f5663cfff4634b4bad5e46017b076dcc8738966478d4065ac3e
SHA3-384 hash: 9f016341375ba9298e07bac9185dac0cff9c0bb4b86e984267d9e02503a9c97a79e08f03284a2e999724d18a78ae1be1
SHA1 hash: 2b7d63d3be1264f799e7e9f6a0875f6d8dc16150
MD5 hash: 6bf275d1ac1e51c7997aecb603fe25e9
humanhash: autumn-wyoming-delta-montana
File name:RFQ-3637829002-AB.PDF.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'096'206 bytes
First seen:2020-06-26 07:41:07 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 24576:qNkBjpDYbshag0qQIYmcZnlGYC5slNNlh6Zp7X/YBrBzn+f:qyrYbqJJc5AYC5C3hMpglBE
TLSH EF353364821BD410FCBE253C0B9436785922ACB7D7E9B425A72C29E7C051D93DFDA363
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail2012.join-me.com.tw
Sending IP: 123.51.190.154
From: Mohd Azual Azrik Bin Ahmad <azrik_800@yahoo.com>
Subject: Request for Quotation
Attachment: RFQ-3637829002-AB.PDF.gz (contains "RFQ-3637829002-AB.exe")

AgentTesla SMTP exfil server:
mail.enmark.com.my:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3dd96ef11b271f5663cfff4634b4bad5e46017b076dcc8738966478d4065ac3e/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 07:43:04 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hxmw54i3e4pvmy6p75ddjnf22xsgaf5qo3omq44jmzdy2qdfvq7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 3dd96ef11b271f5663cfff4634b4bad5e46017b076dcc8738966478d4065ac3e

(this sample)

AgentTesla

Executable exe 0548e8d5359f46894fe4872bbba30cc48775d5fb909eba94e3534c8b018976af

  
Dropping
MD5 e998ea1973929a187abb43749d786855
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0548e8d5359f46894fe4872bbba30cc48775d5fb909eba94e3534c8b018976af

Comments