MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b731cc2495eb957cd55a35a8213f596e81988c194a09a59939b45bab0316ca9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b731cc2495eb957cd55a35a8213f596e81988c194a09a59939b45bab0316ca9
SHA3-384 hash: 6d2a9844246fcacf53fb1f75ae7b543fc5d0b55a4b8a676328453f5034689dbda062c1c182ec19dcab5e37534ed7cef1
SHA1 hash: ad9b95f70c9d7644c41e560530c58c7e8a0bc083
MD5 hash: 56fbf0c37b13ec8712b6cb4c6655028a
humanhash: kansas-moon-freddie-princess
File name:knitted yarn documents.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:341'546 bytes
First seen:2020-11-20 07:49:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:VDPac0OkEmzYat8Wr9sg2W3VwFazymrbO8F22JBceq8rwewPxR:VDPa3OrmXjrGtWFlyEbOw2ecmrwb
TLSH 6574239E138535DF9563366BE6E05370CE45B8BBE809603422FA3EED511BA52200EF73
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.example.com
Sending IP: 107.191.111.26
From: admin@webmail.com
Subject: Fwd: Softener flake for white towel and knitted yarn documents
Attachment: knitted yarn documents.zip (contains "knitted yarn documents.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b731cc2495eb957cd55a35a8213f596e81988c194a09a59939b45bab0316ca9/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-11-20 07:50:09 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hnzrzqsjl24vptkvunniee7vs3ubtcgbssqjuwmttnc3vmbrnsuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3b731cc2495eb957cd55a35a8213f596e81988c194a09a59939b45bab0316ca9

(this sample)

AgentTesla

Executable exe e10c50ccf291423e5b5205ceb99349f63dcdface40517c70bf7486f119ec1ee4

  
Dropping
MD5 dcc2c013daeefcd79c6e634505fe895c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e10c50ccf291423e5b5205ceb99349f63dcdface40517c70bf7486f119ec1ee4

Comments