MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3f31078ca66bb0857e04bce1222ab40f8e536c66c64f6c4de241caf7415e0f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3f31078ca66bb0857e04bce1222ab40f8e536c66c64f6c4de241caf7415e0f1
SHA3-384 hash: 5ca40404d275ce71e42e8cdb2215a40c6efea063e26bd0a9e65ee8a799e643aae15583a708aae31d67934c4b3e83afc1
SHA1 hash: b18cd89b8b9fee1efb58bb85d1fbf49c5ea74bdd
MD5 hash: 0514c4d311ce1aca80f37250b24b4152
humanhash: earth-utah-sweet-echo
File name:PO-.414 Order 1.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:282'751 bytes
First seen:2020-07-07 09:08:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:EAM5cS3UYJ2qJebPtOVeoX+/dYs6C2J5asv/iuugZLffr7dF3L/hozZZd:9Qpp1J1VdOCx5LruSflF3cZD
TLSH BA5423844E7ACD9443A2EEDB3F7F0F7ED595C0708928A274A21CE441BE2ADC19DE0479
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: rahman-group.com
Sending IP: 103.147.185.105
From: SHAHID <info@rahman-group.com>
Reply-To: SHAHID <mnm_vsi@mail.ru>
Subject: QUOTATION REQUIRE FOR PO-.414 Order
Attachment: PO-.414 Order 1.zip (contains "PO-.414 Order 1.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3f31078ca66bb0857e04bce1222ab40f8e536c66c64f6c4de241caf7415e0f1/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 09:10:06 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wpzra6gkm25qqv7ajphbeivlid4oknwgnrspnrg6eqok65av4dyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b3f31078ca66bb0857e04bce1222ab40f8e536c66c64f6c4de241caf7415e0f1

(this sample)

AgentTesla

Executable exe 7b6327de8bc2bfeb87efeb5d5846824813caca6bba489ac19fa4c0e72b144b60

  
Dropping
MD5 7a8db372724522ffa05a45c80a921e31
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7b6327de8bc2bfeb87efeb5d5846824813caca6bba489ac19fa4c0e72b144b60

Comments