MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ed5191aafea01158bdb6e466e48db8e946b66bb11e6471afad22a80be8248f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ed5191aafea01158bdb6e466e48db8e946b66bb11e6471afad22a80be8248f8
SHA3-384 hash: 2e61251ec03591857d0bdb4148758e587b88bbcddb21464635a804c2b8b452d15abc255d17a1c117cbb5bbd401aeec5b
SHA1 hash: 713d107bddabc224e518dbb3480c65de0a17b610
MD5 hash: 3a0451a40c1526974f24e50f770e783f
humanhash: river-asparagus-mexico-autumn
File name:Packing List.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:391'509 bytes
First seen:2020-08-17 08:08:33 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:GaMnolLIGfeyIS+1ZmCCULCRjkLcz48NIE3r5Hv+S4ipfJXQ4D/L/Gkb1+o6s2o3:GPno+UeS+1ZRCJkAz48NIWr1mErQiLBL
TLSH BE8423D4186F33382C574EE9115658A4BB8DBCE0D67AC78C98F4BF6868AD6562C340CF
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: abaad.om
Sending IP: 37.49.230.200
From: Syamkumar Korat <syam.kumar@abaad.om>
Subject: Bank Transfer Advice
Attachment: Packing List.Z (contains "Packing List.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ed5191aafea01158bdb6e466e48db8e946b66bb11e6471afad22a80be8248f8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 08:10:09 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h3krsgvp5iarlc63nzdg4sg3r2kgwzv3chteogx22ivibpucjd4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3ed5191aafea01158bdb6e466e48db8e946b66bb11e6471afad22a80be8248f8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 3ed5191aafea01158bdb6e466e48db8e946b66bb11e6471afad22a80be8248f8

(this sample)

AgentTesla

Executable exe 1d835ccaee0da78b01a8e8b1d738f195c8fc08ddcfa7da17223645a2bf47df04

  
Dropping
MD5 109f44025e9798675d4b73a53f3c266e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1d835ccaee0da78b01a8e8b1d738f195c8fc08ddcfa7da17223645a2bf47df04

Comments