MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3698c6b8a01fc41bf271386a4aa8bc2848914859ee3182f33e23961f78fb16b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3698c6b8a01fc41bf271386a4aa8bc2848914859ee3182f33e23961f78fb16b8
SHA3-384 hash: 4ba587a94b6634147e510885789ddbbe6e699eb3a3115f1527b8452ca5e6395f3ac22cded3107e0ff0caacda17ab9c27
SHA1 hash: 08d45f2fec8b283ac263d4709938533ee293f375
MD5 hash: e7c50ebfb82bc3a88ff9f9f1fa40d451
humanhash: pizza-oregon-iowa-river
File name:ORDER FORMS.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:657'223 bytes
First seen:2020-06-12 07:00:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:tX1484Fr/RFsc95gkkCTIj/DIV3hQrkJDRxq5JyBheT:lazr5WG/szMdNJDXBOT
TLSH 8DE42359C507223BC901A95B200EB5C17D63DBC1EF6EB6D8DEDF0E0E3638989D8A51E1
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: apollo.t.mk
Sending IP: 195.26.152.35
From: ortodoncija1@t.mk <ortodoncija1@t.mk>
Subject: BOOKING
Attachment: ORDER FORMS.zip (contains "ORDER FORMS..exe")

AgentTesla SMTP exfil server:
mail.radiomeff.mk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.gc.931.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-06-12 07:02:11 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g2mmnofad7cbx4trhbvevkf4fbejcscz5yyyf4z6eolb66h3c24a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3698c6b8a01fc41bf271386a4aa8bc2848914859ee3182f33e23961f78fb16b8

(this sample)

AgentTesla

Executable exe d24e24c8882b4e2c4536fa7f250cfb7255a0f68e8514a6395b6fae251483da56

  
Dropping
MD5 f81f652ca3c8a197be490ce764e1a0c6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d24e24c8882b4e2c4536fa7f250cfb7255a0f68e8514a6395b6fae251483da56

Comments