MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 592e243a2d12c70c2d1e2ab386fc717a188937426ffe6188a4f3bc697c782018. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 592e243a2d12c70c2d1e2ab386fc717a188937426ffe6188a4f3bc697c782018
SHA3-384 hash: 84ce09b5bc76abf49e7d015b282ec4891171e3d50dd6f7b7d651bef2ad0369ca812b893faf8198b6c33613c98a2c7643
SHA1 hash: f2d50ba04038a9b31aba91ce4703c7c5c4e3e5c9
MD5 hash: 88c27286fc07aff80e0f5417a5e9e68b
humanhash: nitrogen-tennessee-nineteen-sad
File name:Proforma faktura 05.08.2020.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:418'998 bytes
First seen:2020-08-05 08:30:51 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:Kx3pzwKxrFuxPVJnVhs94FcUzWIMQ3mP9r:KLEKdFuxXtrSI8h
TLSH 4A9423B1203DA73545C2F1625F02DFE637B53A59A1D5B928C0B0F7C8681C368E762AED
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: fosetico.com
Sending IP: 109.228.8.101
From: Martin Bakala <martinbakala4@gmail.com>
Subject: Proforma faktura 05.08.2020
Attachment: Proforma faktura 05.08.2020.7z (contains "Proforma faktura 05.08.2020.exe")

AgentTesla FTP exfil server:
ftp.fratellidelpiano.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/592e243a2d12c70c2d1e2ab386fc717a188937426ffe6188a4f3bc697c782018/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:32:06 UTC
AV detection:
19 of 46 (41.30%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lexciorncldqyli6fkzyn7drpimisn2cn77gdcfe6o6gs7dyeama._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/592e243a2d12c70c2d1e2ab386fc717a188937426ffe6188a4f3bc697c782018

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 592e243a2d12c70c2d1e2ab386fc717a188937426ffe6188a4f3bc697c782018

(this sample)

AgentTesla

Executable exe 8ec6be5f0aa7e1ac4aae554d03ab7189f5523fcbc0fda6eba1261d952b3a3246

  
Dropping
MD5 61157457265e145de8823bca43f71419
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8ec6be5f0aa7e1ac4aae554d03ab7189f5523fcbc0fda6eba1261d952b3a3246

Comments