MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3b9d8ffd218fd86d7210e47797e84319c644d693823f2ac6516eb41f415e508. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3b9d8ffd218fd86d7210e47797e84319c644d693823f2ac6516eb41f415e508
SHA3-384 hash: a3ff6919ac778c750d2bbc02c4b54564fd9a3f8a46f538a07b9fce62c09b1aaff6b58562f135f1494a0da60d3c02f080
SHA1 hash: 0c051a1c7ae4f8c4084613f7918cdd4976800f2e
MD5 hash: 8e4c1eb44b812fd1159b45a4b565801e
humanhash: nineteen-august-network-stream
File name:JQ2341024749.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:472'449 bytes
First seen:2020-07-29 06:42:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:aQ9+VH1JZ0ydLrB71eD7RxP5JTn03ZmAY:99+lOOrBheDN3N0p0
TLSH C2A423F26A8DBA0FD93E1DB39122C785DD36219553CB7B347AA1DFEFDA029711200681
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: business18-3.web-hosting.com
Sending IP: 198.54.115.254
From: RESERVATIONS WEST BEACH CAMP <reservations@naivashawestbeachcamp.co.ke>
Reply-To: betheldavid63@gmail.com
Subject: RE: [Quote JQ2341024749]RE: new RFQ
Attachment: JQ2341024749.pdf.zip (contains "JQ2341024749.pdf.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3b9d8ffd218fd86d7210e47797e84319c644d693823f2ac6516eb41f415e508/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 06:44:09 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wo45r76sdd6ynvzbbzdxs7ueggogitljhar7fldfc3vud5av4uea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b3b9d8ffd218fd86d7210e47797e84319c644d693823f2ac6516eb41f415e508

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b3b9d8ffd218fd86d7210e47797e84319c644d693823f2ac6516eb41f415e508

(this sample)

AgentTesla

Executable exe 634fe7f055e811f93c607b8e6f3333c2a5708236637c1accb3965284d82651bb

  
Dropping
MD5 ec2b6d7e8ae5d44ba3a574c11932b1ea
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 634fe7f055e811f93c607b8e6f3333c2a5708236637c1accb3965284d82651bb

Comments