MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cab48c42a443f01761dc30a3248c8ec757acd4df407df991ec2fedd70bba2d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9cab48c42a443f01761dc30a3248c8ec757acd4df407df991ec2fedd70bba2d8
SHA3-384 hash: e03a12536562a46897f7efe40b75da30fb588b438e936fad1f85f1ecfda673b527d653be6ce3ff6a982445a8142410c8
SHA1 hash: 8872bf4c881d4da755e9478a749523088207e7d8
MD5 hash: 0745c61b73a7b3bfc7125b2085eda9b2
humanhash: venus-yankee-edward-foxtrot
File name:Facturas Pagadas al Vencimiento.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:424'861 bytes
First seen:2020-06-25 13:09:09 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:VnlT4HzYthF9FafvIWTUXGEEpwM/5PYm/bZbw9sXNhe:B04hL0KhSwMBPYm/tbw9s3e
TLSH A694237BC02213AADFF9CF1AA57BBA36A529D0718271A31378F56D932CD2C0C4447E65
Reporter abuse_ch
Tags:AgentTesla BBVA ESP geo r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.s070039.furanet.com
Sending IP: 93.93.70.39
From: Confirmingbbbva@bbva.com
Subject: BBVA-Confirming Facturas Pagadas al Vencimiento
Attachment: Facturas Pagadas al Vencimiento.r00 (contains "Facturas Pagadas al Vencimiento.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9cab48c42a443f01761dc30a3248c8ec757acd4df407df991ec2fedd70bba2d8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 13:53:49 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tsvurrbkiq7qc5q5ymfdesgi5r2xvtkn6qd57gi6yl7n24f3ulma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 9cab48c42a443f01761dc30a3248c8ec757acd4df407df991ec2fedd70bba2d8

(this sample)

AgentTesla

Executable exe ac979891a231a3af79a31a52663f77fe151bbbddee9b13750ea02e82f6aefd40

  
Dropping
MD5 d1c78423165fbff2c47ffa3d31680456
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ac979891a231a3af79a31a52663f77fe151bbbddee9b13750ea02e82f6aefd40

Comments