MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3edbfa536e3f17dd5197bad95088e58fc5762a45dcf6152802dcd3cb289d6976. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3edbfa536e3f17dd5197bad95088e58fc5762a45dcf6152802dcd3cb289d6976
SHA3-384 hash: e2940eb5c20b33f3fb2790414beddf72717f874b98f08c7575534f836d457b8bf0237c1f43a364bc0ae6a0a561b9af50
SHA1 hash: 64476e635c84ebbd9cc21da565996854e4f26d85
MD5 hash: 6c9d5f8c9963149c1fa5d48696b27c20
humanhash: sweet-blossom-snake-juliet
File name:scan11062020.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:424'204 bytes
First seen:2020-06-29 12:36:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:b9RPdQhMhdiKtWYWQorZC7+4+IAe+rctUmRv2:bDPEMhd5tWYWhR4+IMsUmRv2
TLSH F594230D19000EBA661DF1C810C8A6F4B217327A645385C8BAE6BF56FB0355FFA47BD6
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: akkatoglu.com
Sending IP: 103.99.1.149
From: Fatemeh Mahini <munir@akkatoglu.com>
Subject: RE:Request for Quotation - Urgent 6/29/2020
Attachment: scan11062020.zip (contains "scan11062020.exe")

AgentTesla SMTP exfil server:
mail.pptoursperu.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ENGK.190.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3edbfa536e3f17dd5197bad95088e58fc5762a45dcf6152802dcd3cb289d6976/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 12:38:08 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h3n7uu3oh4l52umxxlmvbchfr7cxmksf3t3bkkac3tj4wke5nf3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3edbfa536e3f17dd5197bad95088e58fc5762a45dcf6152802dcd3cb289d6976

(this sample)

AgentTesla

Executable exe d2fc8ce856e5259480e5dd3e9d2f76a24242d5e52f656fa9d0f87bdd57b18f6a

  
Dropping
MD5 9e0f05b03c09d15ca55851c8644a5684
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d2fc8ce856e5259480e5dd3e9d2f76a24242d5e52f656fa9d0f87bdd57b18f6a

Comments