MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f4cd9a9b3843807dd60c089943736ec5f23fffdf304d6c4a29a380ff8fe06ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3f4cd9a9b3843807dd60c089943736ec5f23fffdf304d6c4a29a380ff8fe06ef
SHA3-384 hash: 8199e1591396a599175cd6da3c9843fc413c44e4e8be183ab0f1f43c7c52f341b5b60d68c3aee92734cd45eb0cdc5241
SHA1 hash: 9ba9217e82fc6d93571af5ecbfa1bac478e72a5b
MD5 hash: 28c3da0b32e2480570705bc444dc95cc
humanhash: asparagus-mississippi-nine-timing
File name:Confirmation slip.22mb.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'412'883 bytes
First seen:2020-05-07 15:35:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:kB2d2h2XrEYUYe2RHbUMcUXF5Domray7dfc6ARZfHHQ5W:g2dtr4YxRo3UXFNo6fMHf
TLSH EE653393E5CF64610899E805D05400DD78F6F3DC1BB096AEF31A72DC6EE625822DBE93
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

Sending IP: 185.165.116.18
From: ETZEL FREDDERCKE <info@af-gmbh.de>
Reply-To: Purchase <m.d-af@gmail.com>
Reply-To: Purchase <m.d-af@gmail.com>
Subject: Transfer Payment Slip/Stay safe from coronvirus.
Attachment: Confirmation slip.22mb.zip (contains "Confirmation slip.22mb.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 16:35:51 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h5gntkntqq4apxlaycezinzw5rpsh7756mcnnrfcti4a76h6a3xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3f4cd9a9b3843807dd60c089943736ec5f23fffdf304d6c4a29a380ff8fe06ef

(this sample)

AgentTesla

Executable exe 949837f9631acb0f8687c485fbce98349093f8cd11031e2d634acecca71785a3

  
Dropping
MD5 3c033725b66570f5197d14ce64f28477
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 949837f9631acb0f8687c485fbce98349093f8cd11031e2d634acecca71785a3

Comments