MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 595d671bff43347b57006af44a26234346e0992791e8bdcecd0e1464f66d1d01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 595d671bff43347b57006af44a26234346e0992791e8bdcecd0e1464f66d1d01
SHA3-384 hash: 37a00d9c616e80bc2567a253fedbdc0dd31955524f50cf07bfca6f54add027ac398aa54417d3f6b9b6f53ab7a7568be1
SHA1 hash: 89604d4c65c240d1440f1ebb29d7e95c841e4bc6
MD5 hash: 595f16b752b41066345125c2b6e2adb3
humanhash: minnesota-sierra-batman-don
File name:Facturas Pagadas al Vencimiento.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:430'452 bytes
First seen:2020-05-14 17:29:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:ev++Z09qBDx8L7zKHioeCMQnVVp+w9fi4ca/EL:nqByLaHUC1Vp+w96G8L
TLSH B69423C740A46D296C605152426334FB9BB817ABBFD9AF4BFE9B0CE0035B6591DC24F8
Reporter abuse_ch
Tags:AgentTesla BBVA ESP geo rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vxadv-38.srv.cat
Sending IP: 134.0.8.151
From: Confirming.bbva@bbva.com
Subject: BBVA-Confirming Facturas Pagadas al Vencimiento
Attachment: Facturas Pagadas al Vencimiento.rar (contains "Facturas Pagadas al Vencimiento.exe")

AgentTesla SMTP exfil server:
mail.jjfconsultores.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 17:35:53 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
13 of 31 (41.94%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lfowog77im2hwvyanl2eujrdindobgjhshul3twnbykgj5tnduaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 595d671bff43347b57006af44a26234346e0992791e8bdcecd0e1464f66d1d01

(this sample)

AgentTesla

Executable exe edb8c081034a6b1e130575163fcf1ace66ebd3dc18bcfc634ecc0f6949b6ac54

  
Dropping
MD5 9ad7b4dd1bd6340253ecad061ee95b49
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 edb8c081034a6b1e130575163fcf1ace66ebd3dc18bcfc634ecc0f6949b6ac54

Comments