MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3251e8e030bc09c1cbc4ede2a32e7502dbb5779aab30f0719c73f8ba26c06e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3251e8e030bc09c1cbc4ede2a32e7502dbb5779aab30f0719c73f8ba26c06e6
SHA3-384 hash: 19d4baf48784f85807a4f94611b078aa2b9129a28f1d861c94eb71cdf59b673a9e63db5e76f1acd08255d1bfc85c04c1
SHA1 hash: d65fcf925df91c9e2d94562b41d58621d836b9c7
MD5 hash: fec57d0e40aa755bc541b980e6367114
humanhash: delta-november-oven-fillet
File name:NEW REVISED ORDER.ZX
Download: download sample
Signature AgentTesla
Create hunting rule
File size:713'932 bytes
First seen:2020-08-31 06:25:36 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:1mq6Tk617SjY8RXxbfP9nvsDwjZhsRE5GxiM4mo2JXjaxMNnJxXv07QI13f:h646dSTRhfMgZhdQJJ9JxcQI13f
TLSH 9AE423B1A22BF0957535BB60C777B898F46F370924B44BA17A708DBFE0585683866FC0
Reporter abuse_ch
Tags:AgentTesla Endurance ZX


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: qproxy4-pub.mail.unifiedlayer.com
Sending IP: 66.147.248.250
From: Mimmo Piermarini <mpiermarini@elesia.it>
Reply-To: Mimmo Piermarini <info@deepakengineers.co.in>
Subject: REVISED PURCHASE ORDER
Attachment: NEW REVISED ORDER.ZX (contains "YPeBi8FRoTIc8md.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d3251e8e030bc09c1cbc4ede2a32e7502dbb5779aab30f0719c73f8ba26c06e6/
Threat name:
ByteCode-MSIL.Trojan.Sudloader
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 00:15:16 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2msr5dqdbpajyhf4j3pcumxhkaw3wv3zvkzq6byzy47yxitma3ta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d3251e8e030bc09c1cbc4ede2a32e7502dbb5779aab30f0719c73f8ba26c06e6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d3251e8e030bc09c1cbc4ede2a32e7502dbb5779aab30f0719c73f8ba26c06e6

(this sample)

AgentTesla

Executable exe 604a2f99191e372f62b11a4a1009e8adc41f43a8bbf3f26735549889914f0fc7

  
Dropping
MD5 a3c32145cd008844ed15f214b02e35e4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 604a2f99191e372f62b11a4a1009e8adc41f43a8bbf3f26735549889914f0fc7

Comments