MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bee324db8d9a75f757361aa1b684802ccbfe17b0f98a81d9ab394542d70545d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bee324db8d9a75f757361aa1b684802ccbfe17b0f98a81d9ab394542d70545d6
SHA3-384 hash: 74144d779a9cb3f25c5b2a29a3664c88bfa08727e38ef8440ab372ebb69ff3181ba8fea85e2db026bbf40399afa32baa
SHA1 hash: 96c4f90363162f2264be724bf53fb91d4be45a4e
MD5 hash: d67be7ac02cd0e98246a3db5f3cc0ef5
humanhash: earth-fillet-river-steak
File name:payment slip .z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:559'792 bytes
First seen:2020-08-31 10:49:14 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:uo91zqLIsDco569yeoL8tDvykic7nVEExazshyBwik3U:rzqTAoMkOtDvz7nmYud
TLSH D0C4234D6B4AC04C8FB6AAFA055CEAD420E47787874F60C0BA7919DD1FD07F34EA8496
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.travelkudos.com
Sending IP: 162.241.183.117
From: Head of Financer<hello@hungryghost.sg>
Reply-To: nurlu@ChemoLugano.com
Subject: FWD: Delayed Payment Due To COVID-19 Situation
Attachment: payment slip .z (contains "payment slip ..exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27121.RarHeur.NoDP.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bee324db8d9a75f757361aa1b684802ccbfe17b0f98a81d9ab394542d70545d6/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x3rsjw4ntj27ovzwdkq3nbeaftf74f5q7gfidwnlhfcufvyfixla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bee324db8d9a75f757361aa1b684802ccbfe17b0f98a81d9ab394542d70545d6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z bee324db8d9a75f757361aa1b684802ccbfe17b0f98a81d9ab394542d70545d6

(this sample)

AgentTesla

Executable exe 40f62edaaf245e669c4c4de028657d8762862124d810e9f71184e0dc5ca23df2

  
Dropping
MD5 9b47246feeea57e036332ce0a59fe316
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 40f62edaaf245e669c4c4de028657d8762862124d810e9f71184e0dc5ca23df2

Comments