MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 356dc0f11faf581cf918641504d08fbb462cf6fec24ac887cf794fdb3148d8ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 356dc0f11faf581cf918641504d08fbb462cf6fec24ac887cf794fdb3148d8ee
SHA3-384 hash: 1c8f8e9a13959f5fc517312b177912c3e42fa5239c74e472336551e3b840f99260a7c2a3dd315d218fdbea357de6b427
SHA1 hash: 32801924fc72c3e337dcbda43bbae5b78cb046d0
MD5 hash: 11cf91f5f208fb550e6fc5ad1b3a034b
humanhash: nitrogen-kentucky-orange-july
File name:Company Profile.CAB
Download: download sample
Signature AgentTesla
Create hunting rule
File size:413'910 bytes
First seen:2020-05-23 11:16:18 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:EkZSMgHo21KJIjbvFs4oIS1zMszAYXBWHC4Vbo2RSiUwVHDlSY6Q4h+QkaDHDfZ+:jSJMajbJnS1wAAYkHZoRi3p4Y6QQDrZ+
TLSH AF94235A349DE745F241B8CC78EF7B2513913E2F46A821FDB910FA8C4A0E1233EA9D55
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudhost-144190.uk-south-2.nxcli.net
Sending IP: 165.84.219.64
From: NB_Coatings <info@nbcoatings.com>
Reply-To: jonah@briistol.com
Subject: NBCOATING (lnquiry for Products) 05/23
Attachment: Company Profile.CAB (contains "Company Profile.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21076.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-23 11:35:29 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 356dc0f11faf581cf918641504d08fbb462cf6fec24ac887cf794fdb3148d8ee

(this sample)

AgentTesla

Executable exe 5bc6e2a48a6e75aeee2a6ac4fc410adf13281c1d0a299b3ffe4ee0d036d235df

  
Dropping
MD5 7f78e87d56cbb516015bf8c2846168d5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5bc6e2a48a6e75aeee2a6ac4fc410adf13281c1d0a299b3ffe4ee0d036d235df

Comments