MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32b57a44358ac8512999e93d61cf9e65902e9e660142ba1193ea5dd58e2e2935. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32b57a44358ac8512999e93d61cf9e65902e9e660142ba1193ea5dd58e2e2935
SHA3-384 hash: 5639c7eb2deed06d2a3523db81b5ff8cd6374253c1ec0cd8d462cb1687877103d4363ce4cf7cfa03957d66d3134fe791
SHA1 hash: f19242773d9e8fb6e90674223617b711356ae8cd
MD5 hash: 1a2f48748bd34b040afe8ac36e12dbb7
humanhash: november-delaware-pennsylvania-fourteen
File name:Payment details.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:794'125 bytes
First seen:2020-06-02 12:00:04 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:mmeMUxpVjfI6xx7mOGyH8cP8va3kVD4OmxRiX7zAbIWD+syX7ELYA:6MUxbjfI6xxhG1cQa3WIRiXPWDzgHA
TLSH C8F423B9E6057313852D1F709E8C276800B71A3077FBFA50CB62B9873A165BE9701D6E
Reporter abuse_ch
Tags:AgentTesla rar SendGrid


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: wrqvpcpx.outbound-mail.sendgrid.net
Sending IP: 149.72.60.58
From: MOSHOOD RASITH.B <mager@jscextrusion.com>
Subject: First order payment
Attachment: Payment details.rar (contains "Certificate.exe")

AgentTesla SMTP exfil server:
smtp.seacormerine.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 04:02:26 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gk2xurbvrlefckmz5e6wdt46mwic5htgafbluemt5jo5ldrofe2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 32b57a44358ac8512999e93d61cf9e65902e9e660142ba1193ea5dd58e2e2935

(this sample)

AgentTesla

Executable exe 34b3295ad5896150db239597b0502fb978d98f57550aabce938b9f590b4e9948

  
Dropping
MD5 02eb476442c712e4ceb0fe93b47e0214
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 34b3295ad5896150db239597b0502fb978d98f57550aabce938b9f590b4e9948

Comments