MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3798cb56be080c87f202ba67c7ced1ca1f6b7582b1b4b9a483765c9a1b2efeea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3798cb56be080c87f202ba67c7ced1ca1f6b7582b1b4b9a483765c9a1b2efeea
SHA3-384 hash: 8de420236a835d6982a719339cbb63a00ba38ad5934bc1f35ddf1ed3277c62436f42b291ec35fc72fd7661f6a3f85307
SHA1 hash: 28eac400da0ae9ba4b8bd136d255712e62e082d7
MD5 hash: aa2a28e90a709d17072696cdaf7e58e3
humanhash: avocado-enemy-nine-batman
File name:Electronic payment via Giro.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:414'147 bytes
First seen:2020-06-18 09:53:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:koJqfT3Os7NOF4VeSliR/uSIvWAFuzxk5u/2Po/vN2vM+PVs/8mzabjlDz:kz7esRs4VenRAlV5G2PoEPVs/Z+Z
TLSH 2894238FCD726A9E6F3439D64FCEADD78FC8937737B604A486AD13198C844620D40A27
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ihg.com
Sending IP: 95.211.208.25
From: Accounts Payable <account@ihg.com>
Subject: RE: Electronic payment via Giro
Attachment: Electronic payment via Giro.zip (contains "Electronic payment via Giro.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Generic.fc.30295.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 10:37:10 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g6mmwvv6bagip4qcxjt4ptwrzipww5mcwg2ltjedozojugzo73va._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3798cb56be080c87f202ba67c7ced1ca1f6b7582b1b4b9a483765c9a1b2efeea

(this sample)

AgentTesla

Executable exe d7a0c3c7be706dabddb0998f22caf8369700abcbc5f879bcab8d2aad644a8a04

  
Dropping
MD5 b0102bb6e68eab0861576e6fcdbba11d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d7a0c3c7be706dabddb0998f22caf8369700abcbc5f879bcab8d2aad644a8a04

Comments