MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34e4cb6c72c229387e68d4b9bbdf535279cc0d8efad727ee79acce8fce563fe2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34e4cb6c72c229387e68d4b9bbdf535279cc0d8efad727ee79acce8fce563fe2
SHA3-384 hash: 711b910c398d037ecedf23570864025833dccd54efbc9a0c3e7be2b2c45f70e5c214c3bb341ec1f4681aca6fc54ca400
SHA1 hash: a76369c76e0e55a8b8da8a5b0d7148ee73780361
MD5 hash: 363438c1e97df485c8a5f1ff53a1c57b
humanhash: summer-california-spring-speaker
File name:COMMERCIAL INV-PL_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:370'441 bytes
First seen:2020-08-16 14:51:50 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:O8O5zv+1mtSLovQ4NDaoDorOdOVnJt1P76Khv7Ii95w9sDP0PMZWlfHlDnm0bT:+xXtuetTDgGSnJXP76K1b491M+/lt
TLSH 8A7423521E70D6566C9F28CFEC0428C3431379A5FAEC8CD3E3326641CBABE9D9615276
Reporter abuse_ch
Tags:AgentTesla Maersk rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.hooberhost.com
Sending IP: 91.98.97.245
From: MAERKS SHIPPING LINE <s.nasrollahi@aiti.org.ir>
Reply-To: s.nasrollahi@aiti.org.ir
Subject: Shipping documents
Attachment: COMMERCIAL INV-PL_pdf.rar (contains "COMMERCIAL INV-PL_pdf.exe")

AgentTesla SMTP exfil server:
mail.gascuenca.es:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34e4cb6c72c229387e68d4b9bbdf535279cc0d8efad727ee79acce8fce563fe2/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-08-16 14:53:08 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gtsmw3dsyiutq7ti2s43xx2tkj44ydmo7llsp3tzvthi7tswh7ra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/34e4cb6c72c229387e68d4b9bbdf535279cc0d8efad727ee79acce8fce563fe2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 34e4cb6c72c229387e68d4b9bbdf535279cc0d8efad727ee79acce8fce563fe2

(this sample)

AgentTesla

Executable exe e290e14bd99ee48d3d9b39fb7d0a56f29f83309d86214084d23e00c44971508c

  
Dropping
MD5 122d543562237cfa62c18118afa03690
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e290e14bd99ee48d3d9b39fb7d0a56f29f83309d86214084d23e00c44971508c

Comments