MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3648243efca4c819ab67ce3c22aa6690317121c0b01331db80ba72358a2adb6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3648243efca4c819ab67ce3c22aa6690317121c0b01331db80ba72358a2adb6
SHA3-384 hash: a8858d1c39b0529d178cc0dd77c520245ac1a60845656e256b38f95db6e0ecf7fc877a63885b06f79315bd4dd181f56f
SHA1 hash: a62ae3d479c8d0fd1ff1fc4d387ac06b187eb9cf
MD5 hash: 0889351d761f233062360473d52bcf13
humanhash: zebra-mountain-emma-summer
File name:pO 20-1716.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:412'215 bytes
First seen:2020-06-15 05:38:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:8YVQF+W9OVeUxCZwrcAfoQRd2ydOVdaLUTbtDjyeHppwr56Zn:8YVO+WEVedu9rwdau1jmSn
TLSH EF94233AE7AD03C33C4C437B606F84A956EECDDD22A725A174D8316C40AF74ED5A36A1
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.yuzhani-group.com
Sending IP: 45.95.169.107
From: Gabriel Spanu <info@yuzhani-group.com>
Subject: previous offer
Attachment: pO 20-1716.zip (contains "new purchase order for pO# 20-1716 WOODLAND AND FOODS.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generik.XCVHX.10037.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 05:40:05 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wnsieq7pzjgidgvwptr4ekvgnebroeq4bmatghnybotsgwfcvw3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b3648243efca4c819ab67ce3c22aa6690317121c0b01331db80ba72358a2adb6

(this sample)

AgentTesla

Executable exe 3c1c87b3785b1643eb9c1f44286594879683b8993bd68f5ce0508d45e81201d0

  
Dropping
MD5 3780b1dee7eab3c6760a4c22efc3ebc7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3c1c87b3785b1643eb9c1f44286594879683b8993bd68f5ce0508d45e81201d0

Comments