MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f0f683e003150d534c2e806d6dc70a3c5f4f0297011faee5063780b72c5c08c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3f0f683e003150d534c2e806d6dc70a3c5f4f0297011faee5063780b72c5c08c
SHA3-384 hash: 2eada7b4cdb319ecec284992bdfe9820eabc060b857a120fe0a48c8e3e8c414a6541a47c2314c0ff1053692b66687500
SHA1 hash: adb3bf4fe2b66a978388f56dab3f1f0793d238a5
MD5 hash: 0df8701dd9e3b373ae198117659827ab
humanhash: spring-september-nitrogen-robin
File name:TB-TRADE PTE LTD-SWIFT MT103____________________________________PDF.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:411'323 bytes
First seen:2020-06-15 12:24:03 UTC
Last seen:2020-06-15 14:56:39 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:KMpBWfK4wsgU/72zl/x1QoHluoxGTGbV4:KUgnV/72J/x1BHljxGAV4
TLSH 54942361D36F972A0AA073B9BD4E4B39CF273A22D3DD8AC9218E5DF018E601D8D55CD4
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: intnet.mu
Sending IP: 185.222.57.92
From: Romy Frago <kymoos@intnet.mu>
Subject: Balance/Final Payment of usd$149,650 Completed
Attachment: TB-TRADE PTE LTD-SWIFT MT103____________________________________PDF.gz (contains "TB-TRADE PTE LTD-SWIFT MT103____________________________________PDF.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.8538.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 12:25:06 UTC
AV detection:
34 of 48 (70.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h4hwqpqagfinkngc5adnnxdqupc7j4bjoai7v3sqmn4aw4wfycga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3f0f683e003150d534c2e806d6dc70a3c5f4f0297011faee5063780b72c5c08c

(this sample)

AgentTesla

Executable exe e84fcc93aaa977be76d6f2f875ee8072361282e9edd79b206b370c484f87036e

  
Dropping
MD5 0cf64cf2a3230eeef3e968a52f807fed
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e84fcc93aaa977be76d6f2f875ee8072361282e9edd79b206b370c484f87036e

Comments