MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e359b70c84dabfb939b92f5f5e1e622d49c8a6025d22c452b98e71f17bfc3e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e359b70c84dabfb939b92f5f5e1e622d49c8a6025d22c452b98e71f17bfc3e0
SHA3-384 hash: a4fcd73353532d975a031fa2035310edb3ddff4e19eed8135391999d0a15a4271f6f6225c3a2d9ac5454117756265544
SHA1 hash: b8596ad93db0643917b367402ad030f3b99006a8
MD5 hash: f61b6fc9346dca555c4a64eb276bdaca
humanhash: double-salami-eighteen-saturn
File name:New Invoice.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:836'428 bytes
First seen:2020-11-03 20:41:07 UTC
Last seen:2020-11-04 15:57:54 UTC
File type: zip
MIME type:application/zip
ssdeep 24576:FtkzxvbiX3Kz4BE6kKT9oLLN7ewmc2rhdVFVxfgK:FcvbjKtlSLLNawmcShTRV
TLSH C305331D5C4F20CDB469D61B3D88DE864B497B65ED339B2FE94AEE43AC4E052B764003
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Sales <sales@bertschi.com>"
Received: "from de05.enroot.cloud (de05.enroot.cloud [89.22.105.49]) "
Date: "Tue, 03 Nov 2020 20:14:42 +0100"
Subject: "Re: New Invoice"
Attachment: "New Invoice.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42665.16508.3954.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e359b70c84dabfb939b92f5f5e1e622d49c8a6025d22c452b98e71f17bfc3e0/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-11-03 20:43:05 UTC
File Type:
Binary (Archive)
Extracted files:
39
AV detection:
20 of 29 (68.97%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hy2zw4gijwv7xe43sl27lypgelkjzctaexjcyrjltdtr6f57ypqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3e359b70c84dabfb939b92f5f5e1e622d49c8a6025d22c452b98e71f17bfc3e0

(this sample)

AgentTesla

Executable exe 036dd48f3e384ff6f17b66e565f85807528e39179f43bc474ebd50a4a85c39f5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 036dd48f3e384ff6f17b66e565f85807528e39179f43bc474ebd50a4a85c39f5
  
Dropping
AgentTesla

Comments