MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4e3c9138f1aba28e0fc15ce433e0858897842ea25ff8376923ad13188501389. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4e3c9138f1aba28e0fc15ce433e0858897842ea25ff8376923ad13188501389
SHA3-384 hash: 04d58c5559e34251f3f9928e0b053b17db1fc3e2857d0f45d0245c2b2268bfcc4e3a3e7d29d665cfd46fb422953ef376
SHA1 hash: 1076f9c994d0e37eaf394b3908133225ac0a6443
MD5 hash: e9cd575c1f56ab9279b4aef268c22c62
humanhash: ten-vegan-lamp-artist
File name:PROFORMA INVOICE Inv214 August.cab
Download: download sample
File size:265'494 bytes
First seen:2020-09-02 06:17:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:BqP6iko8eXEB+bJ8W8JHDp4e9scT8fgRefJoQ:Ame0Ba8ZLTCcTik6D
TLSH 654422199EBBBAAD4716E9C4435EE45F54A8DB218049ED4A8E3C118B7E27E338044FC6
Reporter abuse_ch
Tags:cab


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.moenepa.cf
Sending IP: 45.147.162.190
From: Sales3 <admin@moenepa.cf>
Subject: RE: Proforma Invoice for payment
Attachment: PROFORMA INVOICE Inv214 August.cab (contains "PROFORMA INVOICE Inv#214 August.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e4e3c9138f1aba28e0fc15ce433e0858897842ea25ff8376923ad13188501389/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-02 05:19:12 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4tr4se4pdk5cryh4cxhegpqilcexqqxkex7yg5ushlitdccqcoeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e4e3c9138f1aba28e0fc15ce433e0858897842ea25ff8376923ad13188501389

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar e4e3c9138f1aba28e0fc15ce433e0858897842ea25ff8376923ad13188501389

(this sample)

Executable exe 1e9928a54010e7bac001f02719f17a6516ddfc9277a10b8c0863331b0df01007

  
Dropping
MD5 66eb76e032e96fa46e30aa1cf2907dff
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1e9928a54010e7bac001f02719f17a6516ddfc9277a10b8c0863331b0df01007

Comments