MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57a86028ddeb27c9c8a20f83ac654c84dd15e1403721cd457f4af1c7590c86ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 57a86028ddeb27c9c8a20f83ac654c84dd15e1403721cd457f4af1c7590c86ff
SHA3-384 hash: e2efa40fc05a128d48e335b839c19e31611847f044dca0f16201e009423d5475369231d002ca75fdbcefc469f8fcc0ab
SHA1 hash: aaf24f42b58e730e3caba94a6adf58950fe970b8
MD5 hash: 41778a8618692a0b88cf4b07a47f5a5c
humanhash: kansas-uniform-winter-dakota
File name:Facturas revisada.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:377'522 bytes
First seen:2020-08-12 14:32:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:tdc2Y8or6SzfoeC8vnPoEH0vFhAG1OsYhOH2Q7zOdYUPIpkTYJnA3Wp1Fw:g56Szfoe9ng+QFPETQOdrCkT/3k1Fw
TLSH AE84231A3E4ACECC7EA305582FCF4C591A7A05F1E5184E967CB66EE8783B58D0488BC5
Reporter abuse_ch
Tags:AgentTesla ESP geo rar Strato


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mo4-p05-ob.smtp.rzone.de
Sending IP: 85.215.255.131
From: Chrisalmelo! <e-szamlazas@fizetesipont.hu>
Reply-To: e-szamlazas@fizetesipont.hu
Subject: Facturas revisadas (F-K99134 / 20) Notificación
Attachment: Facturas revisada.rar (contains "11.exe")

AgentTesla SMTP exfil server:
mail.umgservicios.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/57a86028ddeb27c9c8a20f83ac654c84dd15e1403721cd457f4af1c7590c86ff/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 14:34:06 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k6ugakg55mt4tsfcb6b2yzkmqtorlykag4q42rl7jly4owimq37q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/57a86028ddeb27c9c8a20f83ac654c84dd15e1403721cd457f4af1c7590c86ff

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 57a86028ddeb27c9c8a20f83ac654c84dd15e1403721cd457f4af1c7590c86ff

(this sample)

AgentTesla

Executable exe e93ac650630bc4b2eab3909ddd47aaa87fec1fc013657039a5c2c1e15fc5d2a2

  
Dropping
MD5 4176633e6210384b6cc59d563f094fba
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e93ac650630bc4b2eab3909ddd47aaa87fec1fc013657039a5c2c1e15fc5d2a2

Comments