MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fbf0430967b2fa0701e2fb6f360e6faee70b6a906d947ae361ebf2e78965262. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3fbf0430967b2fa0701e2fb6f360e6faee70b6a906d947ae361ebf2e78965262
SHA3-384 hash: 6452c11ec5e2f46030a464c00d775099093aa39fc928629b0c112a6cb2e26c701776c1b2f6d9be8302f48b5900335a33
SHA1 hash: 0efdca39bac3e030754349c86b7a14b9f81a8e3a
MD5 hash: 6e8f140d80eb0dde5ebe611ad34326b8
humanhash: summer-leopard-quiet-island
File name:DOCUMENTO DE ENVÍO Y LISTA DE EMBALAJE.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-05 14:55:32 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:TFkguZKC4KONPgSzAQukhR+0nj6G84vT2kEUo:TFkgNC4pNPgSzcQZ6GTfto
TLSH 8445E02113885B9BC37D2A78C44241068FF8ED925363E78EBCA874D557F6F82B311769
Reporter abuse_ch
Tags:AgentTesla ESP geo img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smarthost1.gohsphere.com
Sending IP: 173.0.129.227
From: Brian Martinez <brian.martinez@sanmina.com>
Subject: DOCUMENTO DE ENVÍO Y LISTA DE EMBALAJE--
Attachment: DOCUMENTO DE ENVÍO Y LISTA DE EMBALAJE.IMG (contains "DOCUMENTO DE ENVÍO Y LISTA DE EMBALAJE.PDF.bat")

AgentTesla SMTP exfil server:
mail.soin3.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3fbf0430967b2fa0701e2fb6f360e6faee70b6a906d947ae361ebf2e78965262/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 14:49:27 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h67qimewpmx2a4a6f63pgyhg7lxhbnvja3muplrwd27s46ewkjra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3fbf0430967b2fa0701e2fb6f360e6faee70b6a906d947ae361ebf2e78965262

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 3fbf0430967b2fa0701e2fb6f360e6faee70b6a906d947ae361ebf2e78965262

(this sample)

AgentTesla

Executable exe 27fc7bf4086ffad09feb291debd2bac6ca899d45dd3bc9816a3377e9324348b0

  
Dropping
MD5 1171670b26cf33d8001c987ba10338aa
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 27fc7bf4086ffad09feb291debd2bac6ca899d45dd3bc9816a3377e9324348b0

Comments