MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7bbb0e45876aee89183e85779be4bbf44fd6c12812d414174ceb6cfee4024a63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7bbb0e45876aee89183e85779be4bbf44fd6c12812d414174ceb6cfee4024a63
SHA3-384 hash: 47c57de4bdffd4b4a29dd5e2fb290521f218fc4287f18ea1f7f3eb9838adf3b696a3fbf2717194892d793a0739069587
SHA1 hash: b0472234fe5878f1d5457f6048ae0a0ab9613671
MD5 hash: 1c451e1aa1d26012650adb57f8d83519
humanhash: alabama-two-quebec-wyoming
File name:Payment.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:610'122 bytes
First seen:2020-12-17 08:53:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:3Ah5i5HsmWfGzgcvLUxGio3eopv4DsbtImYGQap+TAMJrK627IKEr:Qh5i5RWfGzgcvL1p3BvIAZ627IKEr
TLSH 88D423E4A1CF0C1E198948B4C1D6AE883AA35634C1E85BFCFEE16185FEB5537980DD4A
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: spe5.ucebox.co.za
Sending IP: 197.242.152.133
From: HAVER NIAGARA GmbH <info@radiancebeautyhub.co.za>
Subject: Re : Payment
Attachment: Payment.rar (contains "Payment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodRar-AIC.18228.15476.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7bbb0e45876aee89183e85779be4bbf44fd6c12812d414174ceb6cfee4024a63/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-12-17 08:54:06 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=po5q4rmhnlxisgb6qv3zxzf36rh5nqjiclkbif2m5nwp5zacjjrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7bbb0e45876aee89183e85779be4bbf44fd6c12812d414174ceb6cfee4024a63

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 7bbb0e45876aee89183e85779be4bbf44fd6c12812d414174ceb6cfee4024a63

(this sample)

AgentTesla

Executable exe 701607597adc3999cb756b5e5205febaf4698ce20a3604e6ad79e49dfd060671

  
Dropping
MD5 c576f125bb9e20097298d58c1f9fa96e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 701607597adc3999cb756b5e5205febaf4698ce20a3604e6ad79e49dfd060671

Comments