MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6594e148fe4af3080868be8883bc9cf97ac208e58339fffe245a174699f2447e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6594e148fe4af3080868be8883bc9cf97ac208e58339fffe245a174699f2447e
SHA3-384 hash: e0e1cc3651b035b9f4f5a376d306a38f7971a915ea165c8631ea77dcfa8acdf2bd77e190bb64d587c9c7122be495cecb
SHA1 hash: ff3be5f084382af912a79d9aab4d99f94d9846c7
MD5 hash: efe350df54b5deb7f2157e84234476c6
humanhash: blossom-aspen-video-low
File name:Facturas pagadas al Ve........7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'325'330 bytes
First seen:2020-07-17 17:21:12 UTC
Last seen:2020-07-17 17:24:25 UTC
File type: 7z
MIME type:application/x-rar
ssdeep 24576:fgaJIndnepFIDi3nf+QQBz+0Z8Cr5z7/xbaiO53soibGN4XMM3PNDpmU75EqXe:owmOaAfxc+0ldz7xbaisibVMM/ND575U
TLSH B75533C900AA557393EC0A00B237B5DFB5B7C2DB4962EF82DD8C7ABC24512D2ED44E16
Reporter abuse_ch
Tags:7z AgentTesla BBVA ESP geo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: fococonsultores.net
Sending IP: 82.223.29.21
From: Confirming.bbva@bbva.com
Subject: BBVA-Confirming Facturas Pagadas al Vencimiento
Attachment: Facturas pagadas al Ve........7z (contains "Facturas pagadas al Ve....bat")

AgentTesla SMTP exfil server:
mail.magicpharma.pt:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6594e148fe4af3080868be8883bc9cf97ac208e58339fffe245a174699f2447e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-17 17:23:04 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mwkocsh6jlzqqcdix2eihpe47f5mechfqm4777relilungpsir7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6594e148fe4af3080868be8883bc9cf97ac208e58339fffe245a174699f2447e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 6594e148fe4af3080868be8883bc9cf97ac208e58339fffe245a174699f2447e

(this sample)

AgentTesla

Executable exe 80e81d5862eeb8f64349e953e74d0ceef0d5a691dfdbf5d9301b9e6d7cc84635

  
Dropping
MD5 f467da4ad4e1b0a1a30ee9aefa881fc0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 80e81d5862eeb8f64349e953e74d0ceef0d5a691dfdbf5d9301b9e6d7cc84635
  
Dropping
SHA256 70c1c70357b6bf9c6ae58213e4c69a6a4d04e2252f60785ca21e9dc5efe0e10f
  
Dropping
MD5 408901a6193714a7eb765852cfb90179

Comments