MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37f17d66cb23f2bdab05cd0da06fd1b4be087e352d9feda1149bca70b46eb9cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37f17d66cb23f2bdab05cd0da06fd1b4be087e352d9feda1149bca70b46eb9cd
SHA3-384 hash: 2d3d609bc9b54cc311ddf9ea1588f9f546533d2bab8b6e6d70751959eaa79acdc00f6a90dab9665754960402c4d767c0
SHA1 hash: 32d02a457b380bf7dbe0664daa062a56b5baef11
MD5 hash: 39a3608ca447cc92b95c4da2c1888494
humanhash: lion-shade-alaska-nine
File name:Paid Invoice.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:407'204 bytes
First seen:2020-06-22 08:15:13 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:JA96G0pXT3ngafCPeWoikOmVYKDgiuzhZ:OuzgZkOfZ
TLSH EB8423178C74EF777A6E02AA369053AFE4B0AE7432657B36AA112EDF324185F508447C
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sohu.com
Sending IP: 193.56.28.145
From: Zachariasz Borkowski<wzhuhui@sohu.com>
Subject: Outstanding Payment
Attachment: Paid Invoice.rar (contains "Paid Invoice.exe")

AgentTesla SMTP exfil server:
mail.zeusinfratech.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27502.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37f17d66cb23f2bdab05cd0da06fd1b4be087e352d9feda1149bca70b46eb9cd/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-06-22 07:24:04 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g7yx2zwlepzl3kyfzug2a36rws7aq7rvfwp63iiutpfhbndoxhgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 37f17d66cb23f2bdab05cd0da06fd1b4be087e352d9feda1149bca70b46eb9cd

(this sample)

AgentTesla

Executable exe 16323d4c8b9b81750381853fb6a76292694aba2e21a74e3bc31ca78f47da4a4e

  
Dropping
MD5 fda60350cbfb46e5b9bf143b60609234
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 16323d4c8b9b81750381853fb6a76292694aba2e21a74e3bc31ca78f47da4a4e

Comments