MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b96e9b61ff6a41882fabbbfcc93130aa4b245fcf4bcaa7e507e1db655aae9b09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b96e9b61ff6a41882fabbbfcc93130aa4b245fcf4bcaa7e507e1db655aae9b09
SHA3-384 hash: 2d3f1fa94d35a5b28472b3ada13acc053cc12c7875472bff020afa8c5acddb2dece4c816b30263c6183e5d598cba44f0
SHA1 hash: aa25bb547c395fc3715c221cda5f37d5231f10b6
MD5 hash: 0ba681b5ab86a6624828f18492f55e88
humanhash: kilo-october-eighteen-emma
File name:Payment Notification.10rar.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:445'220 bytes
First seen:2020-08-04 06:21:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:0YNz+DwVqVlP2QjcoPfX5EjVHoN1q+zSePuq7PUt9Nr:lz6fHP2QjcoHXhzjzSen7UfF
TLSH B694235FF1737606926BD4A88937C392FE10474B90EAEB60844B4CE5FC5658EE3817CA
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: soukopmail.dedicated.co.za
Sending IP: 154.0.162.115
From: Paymentsemail@fnb.co.za
Subject: Payment Notification from MNR DANIEL A BARNARD_TBQ78CMG
Attachment: Payment Notification.10rar.rar (contains "Payment Notification.exe")

AgentTesla SMTP exfil server:
mail.dbbrokers.co.za:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b96e9b61ff6a41882fabbbfcc93130aa4b245fcf4bcaa7e507e1db655aae9b09/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 06:23:05 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xfxjwyp7njayql5lxp6msmjqvjfsix6pjpfkpzih4hnwkwvotmeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b96e9b61ff6a41882fabbbfcc93130aa4b245fcf4bcaa7e507e1db655aae9b09

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar b96e9b61ff6a41882fabbbfcc93130aa4b245fcf4bcaa7e507e1db655aae9b09

(this sample)

AgentTesla

Executable exe 731d6bd52db80b3c422dc2e72e9c17adf0018fe1a392e67d28f642d96c02411e

  
Dropping
MD5 381853a9402e1676357ff00ff4f75875
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 731d6bd52db80b3c422dc2e72e9c17adf0018fe1a392e67d28f642d96c02411e

Comments