MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db3b9bd7d52e0d20154b8e928b0864b84e938b2ca5984cb83b2e2f51b6eec06e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db3b9bd7d52e0d20154b8e928b0864b84e938b2ca5984cb83b2e2f51b6eec06e
SHA3-384 hash: a940ae4cf828ac144df5a162570cf084c7614594126f730dd1b712c13311e680e5f8a11da5fb008609c65e86917ca271
SHA1 hash: 0178407ca44ba6d4143fd856b4f2b43b4f1fdde8
MD5 hash: 422921d591d28469a41687b7ba87d041
humanhash: lion-butter-princess-nitrogen
File name:New proforma Invoice Pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:671'191 bytes
First seen:2020-08-31 05:38:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:6I0tnZOUP5qexuEt/EvU0b3uYl3XEyZaAO47gQjCDpslDNwB80kfw3JA98O8c8et:TRzSLt/EvU0b31lnEyZaAO47HjCD+0kl
TLSH 70E423ADE09DCE7C75DEA5001F1335D07A80806ECCBF1A15FAEAE0E23A509676245F1B
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: "Mr.Rakesh Tate" <rakesh.account_department@gmail.com>
Reply-To: rakesh.account_department@gmail.com
Subject: PROFORMA INVOICE. ( Different Bank Details )
Attachment: New proforma Invoice Pdf.zip (contains "osasuna.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Webalta-6854075-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

PUA.Win.Adware.Webalta-6879873-0
Create hunting rule

SecuriteInfo.com.Trojan.DownLoader34.29944.17906.10656.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/db3b9bd7d52e0d20154b8e928b0864b84e938b2ca5984cb83b2e2f51b6eec06e/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 00:08:34 UTC
AV detection:
34 of 48 (70.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3m5zxv6vfygsafklr2jiwcdexbhjhczmuwmezob3fyxvdnxoybxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/db3b9bd7d52e0d20154b8e928b0864b84e938b2ca5984cb83b2e2f51b6eec06e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip db3b9bd7d52e0d20154b8e928b0864b84e938b2ca5984cb83b2e2f51b6eec06e

(this sample)

AgentTesla

Executable exe 757f7141daf24169ff3694cdf0247b7ce0b71c66a970837a71149a69b5b6d371

  
Dropping
MD5 b6df5864fc6fa87ba731b8986ae5a352
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 757f7141daf24169ff3694cdf0247b7ce0b71c66a970837a71149a69b5b6d371

Comments