MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b851cdb7318d975f510336e3fa77b0c367c45c57173d4f3406c9d1bc369096b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b851cdb7318d975f510336e3fa77b0c367c45c57173d4f3406c9d1bc369096b
SHA3-384 hash: 34383789ecafd376e8f016de488d38c7c9070fbf61c92352479e3b448e8b67788101d5cd3806c6ea1675fc175bca60a1
SHA1 hash: 476ce5fcb018b5df571832093f186c8e87f3fc4f
MD5 hash: a06fc8cf22ec4fe7c1b51443bddba18f
humanhash: sad-grey-violet-illinois
File name:SOA.rar.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'094'282 bytes
First seen:2020-06-18 06:08:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 49152:mjdbuBvB8vLHeB5AJ05VIw3oPLcxNkam7NfWonvk:mjJMBUKBeoKkoPgQN7lBk
TLSH F0A5339B2B0BECCF4931BD7547BEE74E89C160A0C4CD70A4895EA5C10F5BC219C9D2E2
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 1asalldirect.com
Sending IP: 103.99.1.149
From: logistics<logistics@1asalldirect.com>
Subject: RE: updated SOA as of today
Attachment: SOA.rar.zip (contains "SOA.rar.exe")

AgentTesla SMTP exfil server:
mail.parshavayealborz.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Generic.fc.30295.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Infostealer.BitStealer
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 06:10:07 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hocrzw3tddmxl5iqgnxd7j33bq3hyrofofz5j42ansorxq3jbfvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3b851cdb7318d975f510336e3fa77b0c367c45c57173d4f3406c9d1bc369096b

(this sample)

AgentTesla

Executable exe 5f409bddf5b4efe31ec833332774381385c1a31e3e2d8e5e3b2d2f934be0a5a7

  
Dropping
MD5 6e87a2e7ef62721a2aef357431076a7a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5f409bddf5b4efe31ec833332774381385c1a31e3e2d8e5e3b2d2f934be0a5a7

Comments