MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3cbae37aee8d79ec63c4708cf9013ed9b31bccde1d7b901f393d2219fef2fce1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3cbae37aee8d79ec63c4708cf9013ed9b31bccde1d7b901f393d2219fef2fce1
SHA3-384 hash: 1a36d3d437fa3a2e48354c712252e0a707539025f101f2ebee3ccf4d362d94b7151c8fdfe264d39a14745636b77559fc
SHA1 hash: 5d57cd34271d2c87f56e8437de4c2c31587033a4
MD5 hash: 2502f2f845fab7e2f7901a0d1004a9d9
humanhash: utah-fillet-georgia-cup
File name:Payment.tar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'776'431 bytes
First seen:2020-06-12 12:41:57 UTC
Last seen:Never
File type: tar
MIME type:application/x-rar
ssdeep 49152:D5WeUcOG/SaWTr2YO/AHiOBqZxLu1YmGZlzGmuhg/:VeX2A7Bq/Lu1YmGFGmuhg/
TLSH 0B8533D1F7BB4631A51AC86633016E9D71F68A03304915D49F8223EDF3E318FA78976A
Reporter abuse_ch
Tags:AgentTesla tar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: speed.ibxwebsolutions.com
Sending IP: 5.189.181.83
From: nursery@najamalsahraa.com
Subject: Re Payment Advice
Attachment: Payment.tar (contains "Paymentadvce.exe")

AgentTesla SMTP exfil server:
mail.binitoo.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 12:43:05 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hs5og6xorv46yy6eocgpsaj63gzrxtg6dv5zahzzhurbt7xs7tqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

tar 3cbae37aee8d79ec63c4708cf9013ed9b31bccde1d7b901f393d2219fef2fce1

(this sample)

AgentTesla

Executable exe 8ed35bcb3d309f150224f3feb4261974ce96d19c908ba0467c2a2a1a397fba1e

  
Dropping
MD5 a64a53402752c6480f343d6b9637e2d3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8ed35bcb3d309f150224f3feb4261974ce96d19c908ba0467c2a2a1a397fba1e

Comments