MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3ddc52f36a97fb15f5dc56ad33defa3e7402472ccbe4a1d1d1e09f0967e9423. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3ddc52f36a97fb15f5dc56ad33defa3e7402472ccbe4a1d1d1e09f0967e9423
SHA3-384 hash: 59a5c4810a5c06a751dfd493bc692958fee009701e9b396542f163e3454456630948f0ef181d475b46ef27dea5ece992
SHA1 hash: 181921edb64932b263ed9502c92f951c30dceeb2
MD5 hash: 29004890e8bffc1aa03beb61172b29a5
humanhash: stream-avocado-steak-orange
File name:copie_de_plată.pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:351'967 bytes
First seen:2020-05-12 08:56:30 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:l9EITAq1cC0+lNOtJOjuIsd2IaVtW2IdsxSYaTfyqwICjWdBf3dq1aibB73:rEITAAjNCJOKIsd2IX2IQSYGaLI5Fq1Z
TLSH B774231D966E7FF18E2EE7744B78A85F7C1E0B2C2C626CCF681C9C04570513A8A926DD
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: s3w.hu
Sending IP: 195.228.75.172
From: accountant50 <office12@gmail.com>
Subject: dovada de plată de la client
Attachment: copie_de_plată.pdf.7z (contains "copie_de_plată.pdf.exe")

AgentTesla FTP exfil server:
ftp.deep-distribution.ro:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 09:36:46 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wpo4klzwvf73cx25yvvngpppuptuajdszs7euhi5dye7bft6sqrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z b3ddc52f36a97fb15f5dc56ad33defa3e7402472ccbe4a1d1d1e09f0967e9423

(this sample)

AgentTesla

Executable exe bb524192c26b8c0e926d80b15969b5110c50a2bbcad9836d7d5bed4e61109192

  
Dropping
MD5 5fda1360e88b6c940b327dcc5bd52784
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bb524192c26b8c0e926d80b15969b5110c50a2bbcad9836d7d5bed4e61109192

Comments