MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a8378e0728ac012e359ec46f173f42607e4527889a03c44cf0d98077a2b93f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a8378e0728ac012e359ec46f173f42607e4527889a03c44cf0d98077a2b93f3
SHA3-384 hash: a2496e086ce73aac9849082d3545029d203b3388d94018e099acf48d608a8fd40f88fc1e70ab0c2220b1a1fc70676098
SHA1 hash: 751c877a036fb651232b758f31e37573e7263c6f
MD5 hash: 7a14cfe7a0a69bd7e0ae7c6fb04771fb
humanhash: asparagus-equal-neptune-juliet
File name:2020 Shipment details.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:448'171 bytes
First seen:2020-05-06 17:15:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:eja59cglGh6phYGiwdAjs21AItIPRUQ+z8RTPgu6R:eja3Nlc6pZrAjsF1F+zMPF6R
TLSH D39423D88395A7ACD1BB3931B971A6A527C4425070948C97A34F33B1873EA1B5DB3FA0
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server4.justsee.co.in
Sending IP: 180.179.34.100
From: Accounting Xoom Ltd <corrado@m.xoom.com>
Subject: RE: Payments
Attachment: 2020 Shipment details.zip (contains "2020 Shipment details.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-1
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.Nanocore.23.31273.12919.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 17:36:28 UTC
File Type:
Binary (Archive)
Extracted files:
39
AV detection:
36 of 48 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hkbxrydsrlabfy2z5rdpc47ueyd6iutyrgqdyrgpbwmao6rlspzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3a8378e0728ac012e359ec46f173f42607e4527889a03c44cf0d98077a2b93f3

(this sample)

AgentTesla

Executable exe 4ec6d85f82f9d0874d740c3fa5b94c800e25b5dcd05b63135f6da92a8644d70e

  
Dropping
MD5 cfe84f4681713fdc9aada7c5b6331dd0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4ec6d85f82f9d0874d740c3fa5b94c800e25b5dcd05b63135f6da92a8644d70e

Comments