MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41f3f3bd87dd23ac978638b8022bcd30a069d4643efa9d59c53fbaa815bec7a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41f3f3bd87dd23ac978638b8022bcd30a069d4643efa9d59c53fbaa815bec7a0
SHA3-384 hash: 2ee49915e481454d8dc6d098bcccbbe500c77a810f30646221c138c466fae41629dacd883fb732e835a5da7b99ec58aa
SHA1 hash: dbc1411480544c28aedf66f6c79e2674a5fa8825
MD5 hash: e3360f9087c4b30555cdf09a3c37a073
humanhash: cold-finch-lima-ceiling
File name:REQUEST FOR QUOTATION TM 102018_PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:408'510 bytes
First seen:2020-05-19 14:45:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:vUIyyU3TkceP1af5jv9kymLY0FbXg4yRTfiFd6bh3i1IyeWtfP67XxEsgoFMm:QySTkPS5jv9400ZXgzTK7B1MWtKVEgMm
TLSH 259423CD13A49CF95AF18E78F019138B1C8592EFDEEE0FB49A89E8C66C95D38014354E
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.istanbulhmclinic.com
Sending IP: 167.172.33.133
From: Barry McIroy <admin@istanbulhmclinic.com>
Subject: REQUEST FOR QUOTATION TM 102018_PDF
Attachment: REQUEST FOR QUOTATION TM 102018_PDF.rar (contains "HIT.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 15:36:09 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ihz7hpmh3ur2zf4ghc4aek6ngcqgtvdeh35j2wofh65kqfn6y6qa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 41f3f3bd87dd23ac978638b8022bcd30a069d4643efa9d59c53fbaa815bec7a0

(this sample)

AgentTesla

Executable exe 69e5a4941d5236dad068202444b9d7e6fa25944daef9f04e3eaf60ab77252ad6

  
Dropping
MD5 d5ca94a178285f520f0763e5b514354d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 69e5a4941d5236dad068202444b9d7e6fa25944daef9f04e3eaf60ab77252ad6

Comments