MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fd1acd571b5a76b511427cbc4a1760b9a6bbccae7666430a85dfa8869814913. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3fd1acd571b5a76b511427cbc4a1760b9a6bbccae7666430a85dfa8869814913
SHA3-384 hash: 3a9ae25013d0446023a3e3b05d9c26c02a62d0ad875bee23d273dba466ae75c8a862680eb847b12bca844c572fe4916d
SHA1 hash: 96844c050c88f34590f8685a0dc1bab02753ed9e
MD5 hash: 08b1c7a4e0266d01e59e4e31fa8ba05a
humanhash: november-pluto-gee-double
File name:MAXIM_PO20200313.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:388'403 bytes
First seen:2020-06-29 07:40:18 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:F9t2H1DEMNsfLoAQyiUn1zAiWU/wctaa8YfGtO7g1YL1eQlYjnmTOlwyWj3ojyNA:F9ti1vqLDAiWU4cttfCOK41eWYjnmTOR
TLSH 13842314A6911B9E83667ACF3AD187981F6BE7803F305F0CE0D9E10B1CD5EB2E56644D
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server0.metosan.cc
Sending IP: 104.168.213.72
From: Emily <info@metosan.cc>
Subject: MAXIM CONTRACT - PO20200313
Attachment: MAXIM_PO20200313.z (contains "MAXIM_PO20200313.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3fd1acd571b5a76b511427cbc4a1760b9a6bbccae7666430a85dfa8869814913/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 07:42:04 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h7i2zvlrwwtwwuiue7f4jilwbongxpgk45tgimfilx5iq2mbjejq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 3fd1acd571b5a76b511427cbc4a1760b9a6bbccae7666430a85dfa8869814913

(this sample)

AgentTesla

Executable exe fbb2948014dda70a83ea7148d077de19ca77edd978b2ad57921d4dd32955aeae

  
Dropping
MD5 f06440061f56d54de6bd9d3dfc658d2f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fbb2948014dda70a83ea7148d077de19ca77edd978b2ad57921d4dd32955aeae

Comments