MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 356dc0f11faf581cf918641504d08fbb462cf6fec24ac887cf794fdb3148d8ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: 356dc0f11faf581cf918641504d08fbb462cf6fec24ac887cf794fdb3148d8ee
SHA1 hash: 32801924fc72c3e337dcbda43bbae5b78cb046d0
MD5 hash: 11cf91f5f208fb550e6fc5ad1b3a034b
File name:Company Profile.CAB
Download: download sample
Signature AgentTesla
File size:413'910 bytes
First seen:2020-05-23 11:16:18 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:EkZSMgHo21KJIjbvFs4oIS1zMszAYXBWHC4Vbo2RSiUwVHDlSY6Q4h+QkaDHDfZ+:jSJMajbJnS1wAAYkHZoRi3p4Y6QQDrZ+
TLSH AF94235A349DE745F241B8CC78EF7B2513913E2F46A821FDB910FA8C4A0E1233EA9D55
Reporter @abuse_ch
Tags:AgentTesla cab


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: cloudhost-144190.uk-south-2.nxcli.net
Sending IP: 165.84.219.64
From: NB_Coatings <info@nbcoatings.com>
Reply-To: jonah@briistol.com
Subject: NBCOATING (lnquiry for Products) 05/23
Attachment: Company Profile.CAB (contains "Company Profile.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 20
Origin country FR FR
ClamAV Sanesecurity.Malware.21076.ZipHeur.UNOFFICIAL
VirusTotal:Virustotal results 18.75%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 356dc0f11faf581cf918641504d08fbb462cf6fec24ac887cf794fdb3148d8ee

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments