MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a3b22c0e988a847843b2cb924c96d45b988cb2ff0823f817ec5f00ecf877eb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a3b22c0e988a847843b2cb924c96d45b988cb2ff0823f817ec5f00ecf877eb9
SHA3-384 hash: 1f09a1a28f05e70c6f72a665c27fdb9fc43fc8199c190edf827bd5f4c379225573341d20c54a2572d6e1efa79599462b
SHA1 hash: 1145df57d759c7575b002896e26f409ba9b97175
MD5 hash: 811e92e731c2c9ec5a264e290944b5a7
humanhash: fourteen-violet-bluebird-skylark
File name:Detalles del banco.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:222'021 bytes
First seen:2020-07-09 14:29:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:MwxLVeklLg9DSRc7hguj0p4hgS7AdvEXH3K12xClk2VDUQlfPr:jrIySmq0p8xyvK66LCl9Pr
TLSH D424234B4DB4B34B93B850CD7E530045D22A4BCEDD2B7D0A35F16C2799BB89A9461F34
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: virt2877.unelink.net
Sending IP: 31.200.242.206
From: Trini Salvá <afisa@afisasombreros.com>
Reply-To: Trini Salvá <info@sweraurg.com>
Subject: Re: Pagos
Attachment: Detalles del banco.rar (contains "Detalles del banco.exe")

AgentTesla SMTP exfil server:
webmail.aurianet.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1a3b22c0e988a847843b2cb924c96d45b988cb2ff0823f817ec5f00ecf877eb9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 10:00:48 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=di5sfqhjrcuepbb3fs4sjslniw4yrszp6cbd7al6yxya5t4hp24q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 1a3b22c0e988a847843b2cb924c96d45b988cb2ff0823f817ec5f00ecf877eb9

(this sample)

AgentTesla

Executable exe f2209224cc5688ee6f73d6d5977b9bdba3996af5d4eb28b523910e4ffb84d313

  
Dropping
MD5 685117bc150a0c93613817fc244eeb76
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f2209224cc5688ee6f73d6d5977b9bdba3996af5d4eb28b523910e4ffb84d313

Comments