MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e62a1a453612894221591b191a6d94a9a20e03de2e02d49c9c03ace77aa7732. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e62a1a453612894221591b191a6d94a9a20e03de2e02d49c9c03ace77aa7732
SHA3-384 hash: e32bdc01cd48853e91f4c2b6db59eb6202607aed88df6698ff804a0b9d4cf40ffec905d5e36980ef7827604c5717bf71
SHA1 hash: 3516ed1752d9a0e86d00c70a88e19d341e50443b
MD5 hash: f112b09906ae224b3289b9a587ee5728
humanhash: sweet-princess-alabama-ink
File name:Golden - Swift CTM.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:707'405 bytes
First seen:2020-10-12 07:32:02 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:k8JKZ7E/VtO+MR+jhB8q8ee7Nb+8jwTl6pQ1cSv9XIsk3na8BbWKpEBtI1l6vQY0:7gsVtOxEjn8BeehNeMQiSv9YsGnQKpWa
TLSH 55E4239F2F1D067821DDDC2B7AE4C7699664993C9EACAED131706030CD9BFCB84A4B41
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: rkr0.618.sievo.ml
Sending IP: 161.35.174.152
From: "Master Golden Swift" <master_goldenswift@ship.wilhelmsen.com>
Subject: Golden Swift: CTM Request for October 2020
Attachment: Golden - Swift CTM.cab (contains "Golden - Swift CTM.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e62a1a453612894221591b191a6d94a9a20e03de2e02d49c9c03ace77aa7732/
Threat name:
ByteCode-MSIL.Backdoor.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 07:33:09 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hzrkdjctmeujiiqvsgyzdjwzjkncbyb54lqc2sojya5m455ko4za._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/3e62a1a453612894221591b191a6d94a9a20e03de2e02d49c9c03ace77aa7732

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 3e62a1a453612894221591b191a6d94a9a20e03de2e02d49c9c03ace77aa7732

(this sample)

AgentTesla

Executable exe 94493ff262c556d80e0cbfd7bb7741003335e4a10f80111b2756499c6cd058f9

  
Dropping
MD5 cd38909d60a5ca2ef9979d572a0b1213
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 94493ff262c556d80e0cbfd7bb7741003335e4a10f80111b2756499c6cd058f9

Comments