MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 032d55216842c7aee46d81c51afa4a3f7716dd06dbb8faeb68017b9035085323. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 032d55216842c7aee46d81c51afa4a3f7716dd06dbb8faeb68017b9035085323
SHA3-384 hash: 3483d375441e8dd228b9b08473c2df7f5d19a0e2bb6fb62e81455cc0348fdd1b76afd7c1be4e62ac6b4f9523fb6595cc
SHA1 hash: 17f5e1a4d2ccb1f16b12571335a91baa193962fa
MD5 hash: 18a3a6a124fd8f7e2008314b09bae5ea
humanhash: bluebird-hamper-six-south
File name:PAYMENT SLIP AND SWIF COPY.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:434'021 bytes
First seen:2020-12-07 19:33:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:McnqNk5eB5sp7DfLO7NauhwhINF8isJ7UI2xO9gOmGwGXYy0LGkbU9QjMu8:hskIB5KLuauhNRsv2xO9gOmGw5akboQg
TLSH 7694234A0DAEC2C64C74940AFE7807F1839661D15852DD2EA27772CC7237C6BB61FAE1
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: host.gtoolswebmail.ga
Sending IP: 52.152.234.132
From: Ibrahim <Ibrahim@hunanpipe.com>
Subject: Confirm Payment
Attachment: PAYMENT SLIP AND SWIF COPY.rar (contains "PAYMENT SLIP AND SWIF COPY.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
144
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/032d55216842c7aee46d81c51afa4a3f7716dd06dbb8faeb68017b9035085323/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-07 19:34:05 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=amwvkiliild25zdnqhcrv6skh53rnxig3o4pv23iaf5zaniikmrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/032d55216842c7aee46d81c51afa4a3f7716dd06dbb8faeb68017b9035085323

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 032d55216842c7aee46d81c51afa4a3f7716dd06dbb8faeb68017b9035085323

(this sample)

AgentTesla

Executable exe 98fb18db59cb89a6d332a223c7b2d547bad41cf3b06ed2eaa75f6894049b5358

  
Dropping
MD5 4e5ad561afa269326f6996394d78d6ef
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 98fb18db59cb89a6d332a223c7b2d547bad41cf3b06ed2eaa75f6894049b5358

Comments