MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ba6bc8895f4f7b5cb211837965491b2609f68e950bc3cfc6a8b57afd4a7b423. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ba6bc8895f4f7b5cb211837965491b2609f68e950bc3cfc6a8b57afd4a7b423
SHA3-384 hash: 3e90bcc0c8a6834353ce1b07a7f33793368344abf8889ee5ddca84dbd8ff03e410eadfa72c3147218d1b3fdef401d59a
SHA1 hash: 1dd8077521902d5f1ce49442a79e80c4c7e31a8c
MD5 hash: 48893c756fc0c4b96070cf43964711a2
humanhash: mike-ceiling-gee-yellow
File name:Order List SYINDAC_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:783'328 bytes
First seen:2021-01-28 06:24:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:ZCedQOj+eHZjYjT/5ynnSH0QiMoAJLFGrnHYhiDrxijN90jihVOW:ZCedNd5juwnDknFUHpDrUjP0W
TLSH EFF423BCB4233A376142D48715F3C93495424D596B0F8A9EF52AF43C1CB1FA2EAC856E
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Randy Breaux <admin@geotestlimited.com>" (likely spoofed)
Received: "from geotestlimited.com (94-100-31-27.static.hvvc.us [94.100.31.27]) "
Date: "27 Jan 2021 20:15:00 -0800"
Subject: "RE: SYINDAC Co-Operation"
Attachment: "Order List SYINDAC_pdf.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ba6bc8895f4f7b5cb211837965491b2609f68e950bc3cfc6a8b57afd4a7b423/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hotlzcev6t33lszbda3zmverwjqj62hjkc6dz7dkrnl27vfhwqrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3ba6bc8895f4f7b5cb211837965491b2609f68e950bc3cfc6a8b57afd4a7b423

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 3ba6bc8895f4f7b5cb211837965491b2609f68e950bc3cfc6a8b57afd4a7b423

(this sample)

AgentTesla

Executable exe 26dad1e44b5d06bcee5cddb288e3cd623da7bfd1d44a68661e27796f32e3de70

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 26dad1e44b5d06bcee5cddb288e3cd623da7bfd1d44a68661e27796f32e3de70

Comments