MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3b8295f6b3580094260cf5a8a26263eb70d8bc844bfd82d7ffee33c1a6da6b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3b8295f6b3580094260cf5a8a26263eb70d8bc844bfd82d7ffee33c1a6da6b5
SHA3-384 hash: 747cd8529033265aefe8996029559e41ce1d5b268ba87016744a399d4b17ddb4b2f1bc9082bc467b776fbf49e2386d6e
SHA1 hash: 4dab510e7105617b29f1d7e4fe2a1f9172b38757
MD5 hash: 4207520acfab5d158134a5c4c242467b
humanhash: skylark-alaska-winter-edward
File name:Business Proposal AECCFC Scope 20200511 ,xls.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:446'205 bytes
First seen:2020-05-11 14:51:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Vf0l5UN7px7Ev/eK/UgJEBGAzlGvGHZ2eIS:V+5Ctk1JJz2lGv82eIS
TLSH A294236DBD20F1946DFB19F3EDDEE4D88F68E70A14D21C70B67AA8662AD2010C74C527
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: aeccfc.com
Sending IP: 103.133.111.162
From: Jessica Kelly <jessica@aeccfc.com>
Subject: RE: Request For Quote (RFQ): Supply
Attachment: Business Proposal AECCFC Scope 20200511 ,xls.zip (contains "Business Proposal AECCFC Scope #20200511.exe")

AgentTesla SMTP exfil server:
mail.ilclaw.com.ph:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48635.7616.25810.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 15:37:26 UTC
AV detection:
19 of 30 (63.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2o4csx3lgwaasqtaz5niujrgh23q3c6iis75qll773rtygtnu22q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d3b8295f6b3580094260cf5a8a26263eb70d8bc844bfd82d7ffee33c1a6da6b5

(this sample)

AgentTesla

Executable exe 8a8ec6bb5e28a1314eab7ff5c9347bf7ddc567d6cd18f68d26abc364cea0ab8f

  
Dropping
MD5 3beb56d44ca6ca36b58b99ccff173d89
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8a8ec6bb5e28a1314eab7ff5c9347bf7ddc567d6cd18f68d26abc364cea0ab8f

Comments