MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bec671cc31691105bf522de39f4d9f4ae380f5cdd994564d29c4bb9bb7cc3a19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bec671cc31691105bf522de39f4d9f4ae380f5cdd994564d29c4bb9bb7cc3a19
SHA3-384 hash: 962b21c07a7b62a50b667fdec4abd9771bcfbf633f6b80727fb59daff3f02d299dc7680398b8fcb36068a98dd8f1a423
SHA1 hash: 72ed0689e866592f3868d45764215fc7b3025a9a
MD5 hash: 0a6ffca8c11070cc42889783d3383c58
humanhash: michigan-ceiling-august-muppet
File name:PAYMENT TRANSFER.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:584'255 bytes
First seen:2020-06-01 09:58:26 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:DvHZPR7M/y4NMODP7AMgCEMjeb4u8ayzU+ylpf1li/c7nHudO3K:DPZ5+y4OeAiEme/2zU7/M3dO3K
TLSH 08C423FE80492FFF44DB3BF2C86D32053554D4B121AA9401615EECEB4768AEF28B095E
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: alhq.com.my
Sending IP: 209.58.149.65
From: YC Ong <yc.ong@alhq.com.my
Reply-To: YC Ong<nealworkrestblades@yahoo.com
Subject: PAYMENT TRANSFER
Attachment: PAYMENT TRANSFER.rar (contains "PAYMENT TRANSFER.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 10:35:33 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x3dhdtbrneiqlp2sfxrz6tm7jlryb5on3gkfmtjjys5zxn6mhimq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar bec671cc31691105bf522de39f4d9f4ae380f5cdd994564d29c4bb9bb7cc3a19

(this sample)

AgentTesla

Executable exe ffe9d4ee82fe122316666879b540fc2f0525bf20408f891076175c43913f4fb7

  
Dropping
MD5 8dccd40f088863274e06a85862df6402
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ffe9d4ee82fe122316666879b540fc2f0525bf20408f891076175c43913f4fb7

Comments