MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e21ee5d916f35e3d33368d60c717a63cf1cac1d0dea026f77b06a4e2f3fd59d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e21ee5d916f35e3d33368d60c717a63cf1cac1d0dea026f77b06a4e2f3fd59d
SHA3-384 hash: 8a40a4f391c278e1792cd52f4a28e3e624c56f9f1154d6083f374f783db1da9c649a010633f30149d56dda1ff36ae6d0
SHA1 hash: 0c72c1fbd2d873b88be681eaf6a6ded3f65f864a
MD5 hash: 600f34049fa5560f92b15edd3c3ebaed
humanhash: mountain-edward-uranus-robin
File name:PaymentNotification.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:401'199 bytes
First seen:2020-05-06 06:17:56 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:wfr8BlBlxvHgK5C/wqJCXNt4T4Z7J7zQE:e8PBlxt4/wPtH7pzQE
TLSH 5084232380339F7995D50D6764F740454CAE3F260F60A6E6B2B101BF9BF6A05B1EE48B
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email
From: "ngcume.siya"<allan@melvin.gq>
Received: from duba.com (unknown [89.40.114.211])
Date: Wed, 6 May 2020 01:44:46 +0300
Subject: Fwd: Payment Notification
Attachment: PaymentNotification.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Nanocore
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 07:47:18 UTC
File Type:
Binary (Archive)
Extracted files:
39
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fyq64xmrn426huztndlay4l2mphrzla5bxvae33xwbve4lz72woq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 2e21ee5d916f35e3d33368d60c717a63cf1cac1d0dea026f77b06a4e2f3fd59d

(this sample)

AgentTesla

Executable exe 32590b9b3bfcfdb90612b8f3f15da11f29bde6c5bd47ed3b61fc701c7073e4d4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 32590b9b3bfcfdb90612b8f3f15da11f29bde6c5bd47ed3b61fc701c7073e4d4
  
Dropping
AgentTesla

Comments