MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf67440ed3f9f97788f24202570449d078ab0ccaa9a722e8a85d6588b220d00b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf67440ed3f9f97788f24202570449d078ab0ccaa9a722e8a85d6588b220d00b
SHA3-384 hash: bfbec085fed3f7c4ccc2522e856513a9561d67004f536444300e5ea2cdcfd2ff337c53db14ec418180eb178a17cde195
SHA1 hash: 5cf670a1d6591ac518dd352a5f56fcc13485d0de
MD5 hash: 8e5dc19a3c99779e04609c50e69f5db8
humanhash: fish-virginia-speaker-fruit
File name:9862833- 3DHSITECH.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:952'135 bytes
First seen:2020-10-20 08:38:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:cWQ/c8R/OvtoJGdHLvKHNKQKqW7fLA8Ea/QdyUtYzbjqeEO4:4Uamvm2HzKKQKqWHnxYdyUtu+z
TLSH 7E1533DB7C1BF1389E7607E14A3FA800A1DF4AF091608D56D995014EDF7BE2634E828A
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-144-89-139.webhostbox.net
Sending IP: 162.144.89.139
From: Jay Firdaus <sales@3dhsitech.com>
Subject: RE: 9862833- 3DHSITECH SDN. BHD. 
Attachment: 9862833- 3DHSITECH.zip (contains "9862833- 3DHSITECH.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf67440ed3f9f97788f24202570449d078ab0ccaa9a722e8a85d6588b220d00b/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 01:00:46 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z5tuidwt7h4xpchsiibfobcj2b4kwdgkvgtsf2filvsyrmra2afq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/cf67440ed3f9f97788f24202570449d078ab0ccaa9a722e8a85d6588b220d00b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip cf67440ed3f9f97788f24202570449d078ab0ccaa9a722e8a85d6588b220d00b

(this sample)

AgentTesla

Executable exe ee320cd34710b3f02f0c469ea19b12de2bafdd8b9533d8a8f2b48d08a111b3ea

  
Dropping
MD5 b2ddb310e5fea6f2b38ee3dc4b35c7e5
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ee320cd34710b3f02f0c469ea19b12de2bafdd8b9533d8a8f2b48d08a111b3ea

Comments