MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3fcf6af7fca7a7ccc0033d650599333a86e37c0f12b64224cbb8fa5fd8616cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3fcf6af7fca7a7ccc0033d650599333a86e37c0f12b64224cbb8fa5fd8616cc
SHA3-384 hash: 2c2c4afc6e95cf865f0212415fee2dc805a8d0296e53d35eab5fa3f106fcb9d15b83c914edb7114098077dfc6e5c2cdb
SHA1 hash: 5ab27b438080b0f723ef4de0ff9ca140023573a1
MD5 hash: 763f3ccdd2e9f131c44bf87a4ff54523
humanhash: quebec-magnesium-pasta-london
File name:DENIM SP-5200.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:655'789 bytes
First seen:2020-10-06 05:41:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:VZ/F2YC4AiMTT7J5c/WRQ+gKa5/lV6FRTNdOspMPFwhWGtJo+NjnNI:D9RCviMTTguq+gpVH6pdOemIpJm
TLSH 77D423DFE3F9A8118A1B159939A31DF7D47CC6AE13C1D3FC8651AA1CC686280B4F5B42
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp117.iad3a.emailsrvr.com
Sending IP: 173.203.187.117
From: Zahra Apparel (Pvt) Ltd. <info@zahraapparel.com>
Subject: FW: DENIM SP-5200 COST AND SAMPLE
Attachment: DENIM SP-5200.zip (contains "DENIM SP-5200.exe")

AgentTesla SMTP exfil server:
smtp.outlook.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a3fcf6af7fca7a7ccc0033d650599333a86e37c0f12b64224cbb8fa5fd8616cc/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 00:02:40 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=up6pnl37zj5hztaagplfawmtgoug4n6a6evwiismxoh2l7mgc3ga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a3fcf6af7fca7a7ccc0033d650599333a86e37c0f12b64224cbb8fa5fd8616cc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a3fcf6af7fca7a7ccc0033d650599333a86e37c0f12b64224cbb8fa5fd8616cc

(this sample)

AgentTesla

Executable exe ab65908627d20a4e4953d8f2834a469ffcc180dbab7a585f4e58b915e18b702e

  
Dropping
MD5 019082a536b21094364f356a3117497a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ab65908627d20a4e4953d8f2834a469ffcc180dbab7a585f4e58b915e18b702e

Comments