MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37f6e2cf46594c16ec945609988d595cdbb2d27feee61d102c6cbc12748ba432. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37f6e2cf46594c16ec945609988d595cdbb2d27feee61d102c6cbc12748ba432
SHA3-384 hash: 739d0e46566cf2118a176b7849d402397865013bc9cf5965262857cb0471550bf970d649861cf1476f10ea48dbda366a
SHA1 hash: 2a39ad7e0ec4b8573cde201342300041a03e3df0
MD5 hash: 2fe73a2a843a36c39b03bfe80959eaaa
humanhash: oven-earth-september-may
File name:BILL OF LADING DOCS.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:765'794 bytes
First seen:2020-11-05 07:18:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:zExUHQS6KMqiW8Y99d4laPWkLgP+ZZat104GdmkNqc5krC94OOqD4yDyUz7kvbDD:zCUwS6dqiWpdcyWrmZK0nmkZReOOqDFq
TLSH 1EF42301C1330B6ACBC756AD2B6D4722E615CDE48A8CA50AC9CFEDBCD710647B4FB951
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Maersk Customer Service <cindy.lu@maersk.com>"
Received: "from sadsra.xyz (rdns0.sadsra.xyz [134.209.64.69]) "
Date: "Wed, 04 Nov 2020 23:39:40 -0500"
Subject: "Longstanding Container(s) : 204103842"
Attachment: "BILL OF LADING DOCS.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37f6e2cf46594c16ec945609988d595cdbb2d27feee61d102c6cbc12748ba432/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-11-05 07:20:05 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g73oft2glfgbn3eukyezrdkzltn3fut753tb2ebmns6be5eluqza._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 37f6e2cf46594c16ec945609988d595cdbb2d27feee61d102c6cbc12748ba432

(this sample)

AgentTesla

Executable exe ca461421154f0bfaa9b24b0ed5ea776ddeffc9775e3fdb4da1339dcc352468c6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ca461421154f0bfaa9b24b0ed5ea776ddeffc9775e3fdb4da1339dcc352468c6
  
Dropping
AgentTesla

Comments