MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bbeb37861f9cdf722992ac225f4bff8ff5bd04557b12089056d4ac4b3cae08d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2bbeb37861f9cdf722992ac225f4bff8ff5bd04557b12089056d4ac4b3cae08d
SHA3-384 hash: ed3859c3a6fc87d29d7d469cbce0763327d0645c9783360b275ea9673116b67caf2eee23d3e6222409888dbe3dd88916
SHA1 hash: a5f5a25e33fd5d45b7c519af1fdeb3c0212bcd03
MD5 hash: b0e09b647197fa5cf3da3502f7da2a2a
humanhash: yankee-sierra-low-west
File name:Payment Advice - Advice RefGLV701475374 Priority payment Customer Ref100000844741.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'012'201 bytes
First seen:2020-07-03 12:36:35 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:2ybUGmUBETqzyAlN3xttPx9GjWOjzA75yblwTW1resZ9UElPSzOL:NbUGgGLv3x17U6o+TcrRZ9UEkzOL
TLSH 8C2533319DBD5C1AEDACA913499B87F1A6FF17879D7419AEF1DE3248C232AA3C50C401
Reporter abuse_ch
Tags:AgentTesla HSBC r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: paramountdxb.paramountdxb.com
Sending IP: 172.98.94.42
From: HSBC Advising Service <advising.service.10525134.856388.2937908728@mail.hsbcnet.hsbc.com>
Subject: Payment Advice - Advice Ref:[GLV701475374] / Priority payment / Customer Ref:[100000844741]
Attachment: Payment Advice - Advice RefGLV701475374 Priority payment Customer Ref100000844741.r00 (contains "FW Payment Advice - Advice Ref[GLV701475374] Priority payment Customer Ref[100000844741].scr")

AgentTesla SMTP exfil server:
smtp.altrii.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2bbeb37861f9cdf722992ac225f4bff8ff5bd04557b12089056d4ac4b3cae08d/
Threat name:
Win32.Trojan.Bluteal
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 12:38:09 UTC
AV detection:
10 of 21 (47.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fo7lg6db7hg7oiuzflbcl5f77d7vxucfk6ysbcifnvfmjm6k4cgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 2bbeb37861f9cdf722992ac225f4bff8ff5bd04557b12089056d4ac4b3cae08d

(this sample)

AgentTesla

Executable exe f6a3616478400ad9ef7ddde32888050dd08b0fbdcf6ad8372aa3bd414e5b4416

  
Dropping
MD5 5937080b11770535042518a8d345b96c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f6a3616478400ad9ef7ddde32888050dd08b0fbdcf6ad8372aa3bd414e5b4416

Comments