MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56f57a387bd860b8767cee180cc25bec83f6307f8d8a9b48f95d10407b39629e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56f57a387bd860b8767cee180cc25bec83f6307f8d8a9b48f95d10407b39629e
SHA3-384 hash: 4b2a3e828d85c58b230303450031a75119acefceff0177a4a0488b9b85da0a412c678f1f7994718029747b6cccd0f59d
SHA1 hash: e0ebd869f6233bf339e18a4e057300749e6f5507
MD5 hash: 5899de7c1fc5113b1558114b279a3cd9
humanhash: nevada-maryland-video-florida
File name:compromiso de pago.r01
Download: download sample
Signature AgentTesla
Create hunting rule
File size:919'404 bytes
First seen:2020-06-04 08:57:13 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 24576:7YXSbhTsu5IvdxfOs/8gurIGwowL/uhxD7M:0XS15uGs/7TOq/uP7M
TLSH 4F1533F88AEA1DECD7B54EBCFE8DC564B711AD4008AFF1224892F113836CD598717A18
Reporter abuse_ch
Tags:AgentTesla r01


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: stilmebel.az
Sending IP: 178.238.233.18
From: info@stilmebel.az
Subject: compromiso de pago
Attachment: compromiso de pago.r01 (contains "compromiso de pago.scr")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.AitInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 09:36:23 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k32xuod33bqlq5t45ymazqs35sb7mmd7rwfjwshzluiea6zzmkpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r01 56f57a387bd860b8767cee180cc25bec83f6307f8d8a9b48f95d10407b39629e

(this sample)

AgentTesla

Executable exe c2d6a58ae4cc93b225f512a127c751c63398d0fdb7f847b77c83cad6cb79e6bd

  
Dropping
MD5 0167bff2ecc404002001199f90d5208f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c2d6a58ae4cc93b225f512a127c751c63398d0fdb7f847b77c83cad6cb79e6bd

Comments