MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fe59fd5866afc71ab08af38b6aabf4009b84a36124245ddfdbe91b424a09605. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3fe59fd5866afc71ab08af38b6aabf4009b84a36124245ddfdbe91b424a09605
SHA3-384 hash: f379e9360d2d63a00b57b4148322c90686b124d7bdcf1762591909a26eb25b73f979295768fc558ee13e5773544aa825
SHA1 hash: 604dd695ec98f4e3437fe8abaed8ded54aa0b142
MD5 hash: 544bca6ad4eba0af018a49154f28f4f5
humanhash: washington-sweet-angel-kilo
File name:Outstanding Invoices 31.05.2020 pdf 2.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'008'629 bytes
First seen:2020-06-08 06:08:52 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 24576:5KYb4Dr0sfESGLpaaNU3Y0a8rNlLlcPc/FYT3jZRVxJhE:5z4/0sfES8paaNArh1lcPc/GbjZRVq
TLSH 742533B737311B5A1345D77BDE9DA32DA8990B226660E03FA1FF958483088D391637E3
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cpanel2.centrin.net.id
Sending IP: 202.146.241.44
From: ACCOUNTS <makeeagalee@yahoo.com>
Reply-To: vifeki3@yandex.com
Subject: Re:Re:Re:account statement with outstanding Invoices
Attachment: Outstanding Invoices 31.05.2020 pdf 2.xz (contains "Outstanding Invoices 31.05.2020 pdf (2).exe")

AgentTesla SMTP exfil server:
mail.rajalakshmi.co.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 06:10:11 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h7sz7vmgnl6hdkyiv44lnkv7iae3qsrwcjbelxp5x2i3ijfasycq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz 3fe59fd5866afc71ab08af38b6aabf4009b84a36124245ddfdbe91b424a09605

(this sample)

AgentTesla

Executable exe 3a07439a1a99adf36ee223fd32595574e6c7803bd380c573a2448be340d50c19

  
Dropping
MD5 3304415f32ae50b39a3af05ea791dd64
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a07439a1a99adf36ee223fd32595574e6c7803bd380c573a2448be340d50c19

Comments