MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3bb1325fbbd24fef1ecbb5a295c391d0eaefe5e2ac30fe85f00fdabb0d168f90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3bb1325fbbd24fef1ecbb5a295c391d0eaefe5e2ac30fe85f00fdabb0d168f90
SHA3-384 hash: 6c77bdd041eacb2a39013f4c5b1b733f4d4ab4e3334c71d9dc0cdf52caefd512270fae201711dd36cd8480aa8d3975fd
SHA1 hash: a24ec78a6be766191100eb84b485cdb8c016193d
MD5 hash: aac91800ea78d05a0394dda3b8c3524b
humanhash: cup-stream-uncle-nevada
File name:PAYMENT.GZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:328'803 bytes
First seen:2020-07-02 12:13:21 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:5wrpcJ/ftnUPGclvLkWm/ycYnI4Xua1utT03PI2gVOoU:5wrpcJRelvqKcYIfIutmgVbU
TLSH 546423D5049585EF7839A37280F15066FE870640DCE6FE5F62D5202CEC968F8AF8F61A
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: linux6.delaweb.net
Sending IP: 213.192.239.139
From: Burns-Shanahan <info@burns-shanahan.ie>
Reply-To: martinmurphy231@outlook.com
Subject: Confirming Payment
Attachment: PAYMENT.GZ (contains "PAYMENT.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3bb1325fbbd24fef1ecbb5a295c391d0eaefe5e2ac30fe85f00fdabb0d168f90/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 12:15:06 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hoytex532jh66hwlwwrjlq4r2dvo7zpcvqyp5bpqb7nlwdiwr6ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 3bb1325fbbd24fef1ecbb5a295c391d0eaefe5e2ac30fe85f00fdabb0d168f90

(this sample)

AgentTesla

Executable exe e6f7924056bd35881ef2373f64f164a02019ff9f1c0ee39af73a81de5c9e8303

  
Dropping
MD5 2733560cda318a22d15380dc2711a6d7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e6f7924056bd35881ef2373f64f164a02019ff9f1c0ee39af73a81de5c9e8303

Comments