MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3eb10979135df86fdb7a5fc627b2ded6444dae36cccbe278c40a822fe3368702. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3eb10979135df86fdb7a5fc627b2ded6444dae36cccbe278c40a822fe3368702
SHA3-384 hash: 04b5468c4c929142f0da4f7eab95053d8b4b1b96a09ca0a37adf5b4248e47e34aa4f94ccdebddac0e8bb0b0b2d611437
SHA1 hash: e1880b8f44c717b6b547a1b300203ac9aba82dd7
MD5 hash: 49dddcfa54696eb09ed4fff618751f13
humanhash: chicken-orange-aspen-diet
File name:Rfq Urgent New Order#001.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:870'400 bytes
First seen:2020-11-25 12:00:09 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:sJyvWv9G2E65VbvS4ySVUlwGjwZeURp4VNu0YPYOk/Vn/Qu9T5zPvE0ML2:sbNvS/lwGjwZ1RyVNuYtn/7x5LvEvL
TLSH C4058C27735C87D8C76C3EF5943001BF31A69E01426DF56CDEEAFC8B5B625A80076A85
Reporter cocaman
Tags:AgentTesla img


Avatar
cocaman
Malicious email (T1566.001)
From: "Poey Eng <poey.eng@ansell.com>" (likely spoofed)
Received: "from ansell.com (unknown [45.137.118.36]) "
Date: "25 Nov 2020 03:19:24 -0800"
Subject: "BVA-E (PO#MT20-0582)"
Attachment: "Rfq Urgent New Order#001.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3eb10979135df86fdb7a5fc627b2ded6444dae36cccbe278c40a822fe3368702/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-25 09:28:34 UTC
File Type:
Binary (Archive)
Extracted files:
22
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h2yqs6itlx4g7w32l7dcpmw62zce3lrwztf6e6gebkbc7yzwq4ba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3eb10979135df86fdb7a5fc627b2ded6444dae36cccbe278c40a822fe3368702

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 3eb10979135df86fdb7a5fc627b2ded6444dae36cccbe278c40a822fe3368702

(this sample)

AgentTesla

Executable exe 0a9ce88cb32da5f8aab38458eb7b58db8ca8250a06e98d6c1a9eda48d7a1aac1

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0a9ce88cb32da5f8aab38458eb7b58db8ca8250a06e98d6c1a9eda48d7a1aac1
  
Dropping
AgentTesla

Comments