MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74ea4075d54f3151e6b3fa44935d3541bcf532775d63d936a36691733886d910. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74ea4075d54f3151e6b3fa44935d3541bcf532775d63d936a36691733886d910
SHA3-384 hash: 03390b29bfec8b30b626670f215481d7700ff56b352f0dbf988f152d69a2752e0a6555fce6bdba78e2e1ed6c3db8b4a6
SHA1 hash: ec211dc08349be20f93662ce9621ec40dd020970
MD5 hash: 6bcb22eae46997b71f3dd53474503787
humanhash: fruit-fruit-texas-friend
File name:169287394-75414-SANWVDDNETP0034-3 4.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:473'983 bytes
First seen:2020-07-28 14:16:49 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:pEwmXun71xqaOdX6Zm1qFknvGBkbA6OVtyDAZ:ml+JwxdX6g4MvbbA6OAG
TLSH 8AA423980CB24BA5C153411EC433BAFAF81F3F0C1C99E753ADBD463EA84B2958A57607
Reporter abuse_ch
Tags:AgentTesla BBVA ESP geo gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: servidor.drapps.info
Sending IP: 31.170.100.61
From: confirming.bbva@bbva.com
Subject: BBVA-Confirming Cesión de Créditos
Attachment: 169287394-75414-SANWVDDNETP0034-3 4.pdf.gz (contains "169287394-75414-SANWVDDNETP0034-3 4.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.52692.31179.7565.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/74ea4075d54f3151e6b3fa44935d3541bcf532775d63d936a36691733886d910/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 14:18:09 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=otvea5ovj4yvdzvt7jcjgxjvig6pkmtxlvr5snvdm2ixgoeg3eia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 74ea4075d54f3151e6b3fa44935d3541bcf532775d63d936a36691733886d910

(this sample)

AgentTesla

Executable exe 3b86298f7b9280b5cb9332c52a36c02386cea08e7b3cef8565bd06cbb08f44cb

  
Dropping
MD5 5d434473eb24eb71a2a6e94c4e6e3c6b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3b86298f7b9280b5cb9332c52a36c02386cea08e7b3cef8565bd06cbb08f44cb

Comments