MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8aa5b5d98d07508eea4a26a100782506525931023ee128c3c01cacd312cdec4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8aa5b5d98d07508eea4a26a100782506525931023ee128c3c01cacd312cdec4e
SHA3-384 hash: 3167a7ff204aa6a8de4bec09b7fc84eddd4e5015fe9117d0769da8995cf4c7559eee5df95e38fed355c194b17219dfba
SHA1 hash: 355d6ee24402e4381686b8ac4c0ddf271daa4e5d
MD5 hash: 0b1368e39486aaaa91b5921a42b2aa12
humanhash: blossom-london-aspen-thirteen
File name:677554435543.GZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:260'567 bytes
First seen:2020-06-15 12:24:44 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:P4QIz5bDz8FHJ/DYfn50gRS54BX0Ps21H+43M+UocC7W7zb:PoxzkJbdgRPk443rctzb
TLSH FF4422B1763CD79ACD24A7D5679082ADA34425215E3C5A1BEC232B362CE56F0F72C98C
Reporter abuse_ch
Tags:AgentTesla ESP geo gz Santander


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: apolov.doblerc.net
Sending IP: 54.36.123.2
From: Factoring y Confirming - Grupo Santander <fycout@gruposantander.com>
Subject: Confirming - Aviso de pago
Attachment: 677554435543.GZ (contains "677554435543.exe")

AgentTesla SMTP exfil server:
smtp.mail.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 12:26:07 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rks3lwmna5ii52ske2qqa6bfazjfsmich3qsrq6adswngewn5rha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 8aa5b5d98d07508eea4a26a100782506525931023ee128c3c01cacd312cdec4e

(this sample)

AgentTesla

Executable exe 77759c93482bc56bbaa7400b0aed98392c447fc568ce80fedbab45aec28012cd

  
Dropping
MD5 692015224481dbc27e269295335ffc69
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 77759c93482bc56bbaa7400b0aed98392c447fc568ce80fedbab45aec28012cd

Comments