MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38683e8ce316331b16ee879e61247f89dd5038964e35e210660a09d91557069f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38683e8ce316331b16ee879e61247f89dd5038964e35e210660a09d91557069f
SHA3-384 hash: f8f736b7017146d35a252cbc8f121f631077701ceceae8a2fa6c25c57dc3fcb0cc83b04a26ff72a85f60a2f266946a96
SHA1 hash: a3ce08b0489267eff267a294a4a235efd8d67565
MD5 hash: 91aab5cb7a340a2d7939d5c91d259a5f
humanhash: enemy-gee-oxygen-island
File name:Facturas Pagadas al Vencimiento.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:655'020 bytes
First seen:2020-07-20 09:22:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:W4UolPJxmGfa+/EV7m0MRkHI0HJ8UQWjBnqGFFUq/SxpZJt5PQRb6e6:flba+/8m0KkHI0HoWjlqSFb/E5oRbp6
TLSH B4D423DD48844D094291BE9777BF7FAC61581A639FBC85A186E2DB2EC6EC9A307034D0
Reporter abuse_ch
Tags:AgentTesla BBVA ESP geo rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.argearts.com
Sending IP: 178.18.206.234
From: Confirming.bbva@bbva.com
Subject: BBVA-Confirming Facturas Pagadas al Vencimiento
Attachment: Facturas Pagadas al Vencimiento.rar (contains "Facturas Pagadas al Vencimiento.exe")

AgentTesla SMTP exfil server:
mail.jjfconsultores.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/38683e8ce316331b16ee879e61247f89dd5038964e35e210660a09d91557069f/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 09:24:06 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hbud5dhdcyzrwfxoq6pgcjd7rhovaoewjy26eedgbie5sfkxa2pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/38683e8ce316331b16ee879e61247f89dd5038964e35e210660a09d91557069f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 38683e8ce316331b16ee879e61247f89dd5038964e35e210660a09d91557069f

(this sample)

AgentTesla

Executable exe ff04d83ea719cc1680374c4c5063436e8adee2b82f33a888883c1ad2655ef517

  
Dropping
MD5 79b73c25c7ac7d5b0af9e060b52d92f9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ff04d83ea719cc1680374c4c5063436e8adee2b82f33a888883c1ad2655ef517

Comments