MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c9b5d66a7ac6aeb8dc8445004573e3a8b56f20ab60d2e6cf38fa18eb61538b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c9b5d66a7ac6aeb8dc8445004573e3a8b56f20ab60d2e6cf38fa18eb61538b5
SHA3-384 hash: 91861c1d59a34f4d19495aca6fa173baca9c9bebda72beb8c3b7fae86e6dc0a2be85370b59db7c989e31a2ee1a7f8f9d
SHA1 hash: 13750bf087eec21f27d2eb78d8534833aa1e4aa7
MD5 hash: 80f4ab27761c2a5c71c15a9b91d7b2c4
humanhash: black-apart-tennis-louisiana
File name:Parking List.pdf...zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:649'462 bytes
First seen:2020-10-16 13:39:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:sqDR7ZQhKNHr6EmftX5A1ZGrKVpG/zvEUDgzUlDz0uppsTEAdqv:DtQcgXfNW1crKVMYUIUlf0upGa
TLSH 4FD4330DCD74368FEEC4E836B4D82787607EA68C2BE01AED64CF0B6C10A2A15175D5A7
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.fpcci.org.pk
Sending IP: 124.29.202.181
From: Sales <sales@bertschi.com>
Subject: RE: Invoice & Packing List
Attachment: Parking List.pdf...zip (contains "Parking List.pdf...exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42621.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3c9b5d66a7ac6aeb8dc8445004573e3a8b56f20ab60d2e6cf38fa18eb61538b5/
Threat name:
ByteCode-MSIL.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 13:41:05 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hsnv2zvhvrvoxdoiiriaivz6hkfvn4qkwygs43htr6qy5nqvhc2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3c9b5d66a7ac6aeb8dc8445004573e3a8b56f20ab60d2e6cf38fa18eb61538b5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3c9b5d66a7ac6aeb8dc8445004573e3a8b56f20ab60d2e6cf38fa18eb61538b5

(this sample)

AgentTesla

Executable exe bb80388ea4df988a288c2d06274aee2b2db7f2e645ce83ad67980624708fbbd7

  
Dropping
MD5 c09bcf5ff3406113ae3a912713a42e1b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bb80388ea4df988a288c2d06274aee2b2db7f2e645ce83ad67980624708fbbd7

Comments