MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 118a5ae2fe8c55caba2d8cf6436f1e4c321afcbfaa7bc4ce5d6cd4560032b80b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 118a5ae2fe8c55caba2d8cf6436f1e4c321afcbfaa7bc4ce5d6cd4560032b80b
SHA3-384 hash: 2aeb8448ae3721143701759bd6f4608e0db7a8998b703b35776a23c22ea98bfebddac403f970ad112880468161a911cb
SHA1 hash: 3cad272db0c26cd1aa82e9681ce1874df1e7ae81
MD5 hash: 975f6e3806b02215fd487b8b65b90ece
humanhash: solar-moon-pizza-delta
File name:Facturas Pagadas al Vencimiento.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:420'018 bytes
First seen:2020-07-01 11:44:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:MnWKu/PBGKTowpMp301q2xkSDqUezTi+mW:MWK5KTdMzLSDqUezu+N
TLSH 6B9423DA9FA284943E5B8CF3453EAF7D87D5D9143BBBF20C0EBAF8B281160442755069
Reporter abuse_ch
Tags:AgentTesla BBVA ESP geo rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server158807.vservers.es
Sending IP: 188.164.194.140
From: Confirming.bbva@bbva.com
Subject: BBVA-Confirming Facturas Pagadas al Vencimiento
Attachment: Facturas Pagadas al Vencimiento.rar (contains "Facturas Pagadas al Vencimiento.exe")

AgentTesla SMTP exfil server:
mail.jjfconsultores.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/118a5ae2fe8c55caba2d8cf6436f1e4c321afcbfaa7bc4ce5d6cd4560032b80b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-01 11:45:06 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cgffvyx6rrk4vornrt3eg3y6jqzbv7f7vj54jts5ntkfmabsxafq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 118a5ae2fe8c55caba2d8cf6436f1e4c321afcbfaa7bc4ce5d6cd4560032b80b

(this sample)

AgentTesla

Executable exe 16a33ff1076ad51388af14a2f735a4de0a205a6a2a658598e11225368d686c10

  
Dropping
MD5 43c744475227eb731f7c1f29b0867db6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 16a33ff1076ad51388af14a2f735a4de0a205a6a2a658598e11225368d686c10

Comments