MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3dfd5cf8a8661a448ac86d4aad831509092bb63556cdea451b8e93f6b678532d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3dfd5cf8a8661a448ac86d4aad831509092bb63556cdea451b8e93f6b678532d
SHA3-384 hash: bcbf920bc7a8ac3faea8f022d5cc297760ca8da93af873cbe32c0b61b7c4f4bf17f065709d818fb5a9d07abb430ae1ad
SHA1 hash: 5735af7b6cdf0c008215a3488484ba8291b0ef5e
MD5 hash: 0a8eef7cbc93852517a554b1a13f31cb
humanhash: white-grey-muppet-equal
File name:RFQ T7-30032020.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:473'665 bytes
First seen:2020-05-25 12:28:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:5AEwnQWtCH+od5zD3vE4inVFLyBt/WznFhkQ:9sQWtCZpD35iVFOBt/eb
TLSH 21A423AF80595708D92CC17DDF790D4BB3EB788E1088845A8597538EBEEE7A012FC85D
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: btechnologiesgroup.com
Sending IP: 45.90.222.41
From: gm@btechnologiesgroup.com
Subject: RFQ T7-30032020 [BT TECHNOLOGIES (M) SDN BHD]
Attachment: RFQ T7-30032020.zip (contains "RFQ T7-30032020.exe")

AgentTesla SMTP exfil server:
smtp.fipco-sa.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Win.Virus.Sality
Create hunting rule

Win.Trojan.VBGeneric-6735885-0
Create hunting rule

Win.Virus.Sality-6747602-0
Create hunting rule

Win.Malware.Swisyn-6803865-0
Create hunting rule

Win.Malware.Swisyn-7610491-0
Create hunting rule

Win.Malware.Swisyn-7610494-0
Create hunting rule

Win.Trojan.Kazy-304
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Swisyn
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 12:36:54 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
37 of 48 (77.08%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3dfd5cf8a8661a448ac86d4aad831509092bb63556cdea451b8e93f6b678532d

(this sample)

AgentTesla

Executable exe 4850ce25c3caf99fc7f558ec6666d08c43d69ed4e1be9a8fd37f289db69561ab

  
Dropping
MD5 a189817dbab853329eb05c34f1c8e5e5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4850ce25c3caf99fc7f558ec6666d08c43d69ed4e1be9a8fd37f289db69561ab

Comments