MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e7bbd3dc7b667c0a9948c627eb79f4c63b8929581b7c11624c1dbeaa319dc51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e7bbd3dc7b667c0a9948c627eb79f4c63b8929581b7c11624c1dbeaa319dc51
SHA3-384 hash: fb82adc8a76b8d2e45febe279cb148b5943dee9f67232fde1d3fec725939bb2614390bcc2480513a90070736d5eccd1d
SHA1 hash: 87694f1b7eb7285374a8e13b408877a88f7f7f54
MD5 hash: 132735e64b8d1ea6e479cfd61ac8f0bb
humanhash: beer-sixteen-eleven-twenty
File name:SC_(_0778965435_)pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:451'015 bytes
First seen:2021-02-26 06:27:21 UTC
Last seen:2021-02-26 17:19:34 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:F/tdoaxlf3o/OPFmavzMOT/yfrS1IZmijvrse:9JgI2zKEwe
TLSH 23A4233B6B3D304054D8AF078E57063F52412B6EDDF22438E5512E52D8EF863EA3E566
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: "Yazuba Group Inc <sales@yazuba.com>" (likely spoofed)
Received: "from yazuba.com (ns556407.ip-139-99-121.net [139.99.121.88]) "
Date: "25 Feb 2021 22:07:48 -0800"
Subject: "Yazuba Group Inc. - Prepayment Status "
Attachment: "SC_(_0778965435_)pdf.gz"

Intelligence

File Origin
# of uploads :
3
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Rogue.0hr.20210226-0108.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e7bbd3dc7b667c0a9948c627eb79f4c63b8929581b7c11624c1dbeaa319dc51/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-02-26 01:17:08 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hz532pohwzt4bkmurrrh5n47jrr3reuvqg34cfreyhn6viyz3riq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3e7bbd3dc7b667c0a9948c627eb79f4c63b8929581b7c11624c1dbeaa319dc51

(this sample)

AgentTesla

Executable exe e0b94624bef25e6b46b21cc3d05ac9582b04d1b2258aaff1d13fc3819079fb3f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e0b94624bef25e6b46b21cc3d05ac9582b04d1b2258aaff1d13fc3819079fb3f
  
Dropping
AgentTesla

Comments