MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8fa324561073132b3417c572851b3fbf8548186fbe87a9a79ddd7ccfd1639ab6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8fa324561073132b3417c572851b3fbf8548186fbe87a9a79ddd7ccfd1639ab6
SHA3-384 hash: 4cb35b7fc8bb3cf11161f1f514c31c61e71e0656b0d7005e3caad3799b19a222a3a2d885382e7e3ea36f55e7618bfbca
SHA1 hash: 220d7bd86768590204b958d55f8cf81451e2ae4f
MD5 hash: 316b30a2d18165ceaa31455b96f43256
humanhash: angel-mike-mississippi-july
File name:Payment Advice.tar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:631'142 bytes
First seen:2020-08-17 06:16:07 UTC
Last seen:Never
File type: tar
MIME type:application/x-rar
ssdeep 12288:PryrgcAGG2/d5nuIk1ZIFu3LMozrrIV2SNkEimNQPf5qRQkfu2vt42wbVHZlVx:TggcGi/n+sgl8tN9imC8eSqhJx
TLSH 65D4237996F8CF8FC0871767096B078D6D707F0635E912C1A8EDB5887786A913CA2D88
Reporter abuse_ch
Tags:AgentTesla HSBC tar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hsbc.com.hk
Sending IP: 37.49.224.210
From: HSBC Advising Service <customerservice@hsbc.com.hk>
Subject: Payment Advice - Advice Ref:[GLV7179483966] / Priority payment / Customer Ref:[ corp940200]
Attachment: Payment Advice.tar (contains "Payment Advice.exe")

AgentTesla SMTP exfil server:
smtp.strongpetrochem-com.me

AgentTesla SMTP exfil email address:
kasim@strongpetrochem-com.me

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8fa324561073132b3417c572851b3fbf8548186fbe87a9a79ddd7ccfd1639ab6/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 06:18:07 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r6rsivqqomjswnaxyvzikgz7x6cuqgdpx2d2tj453v6m7uldtk3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8fa324561073132b3417c572851b3fbf8548186fbe87a9a79ddd7ccfd1639ab6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

tar 8fa324561073132b3417c572851b3fbf8548186fbe87a9a79ddd7ccfd1639ab6

(this sample)

AgentTesla

Executable exe bd3471318776ee818d9f1b68f84d66b63997c2ca1cf7f6d0070560044a00974e

  
Dropping
MD5 4c6b28b6c6a33e80f3634cc918a4c0b9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bd3471318776ee818d9f1b68f84d66b63997c2ca1cf7f6d0070560044a00974e

Comments