MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58919103084b7a2ff2528f2b59ecc6b7a37e4f333270b891801ea7706cc1c517. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58919103084b7a2ff2528f2b59ecc6b7a37e4f333270b891801ea7706cc1c517
SHA3-384 hash: 6ffe7753a24e7024451fe459f0dcb47ec8ec88907495a481b5b4db910d62822fc3ba9f9a0394a156c3dd462124175abc
SHA1 hash: a9ebc986b46009549fc54df7b5f109c42ec77be5
MD5 hash: 88d39de4cbc14782b503fcd444f26911
humanhash: fourteen-saturn-skylark-early
File name:Pass code-HSBC Advising payment service_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:377'858 bytes
First seen:2020-05-28 14:42:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:pIzHhzebUNa+8JgILZe8HyKX3QbEc7TEwgAzoUR3Kajkd/qRo/1ITDDkFtoUVvRY:pIjhzuQIJgaZw4onTEwxMUhkx9eDDkv+
TLSH 6184235F7DB058E4CC934BE0E5459698421754E897B2130EF02A2BE2EEC3AC7FE8215D
Reporter abuse_ch
Tags:AgentTesla HSBC rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.agenciacidadeweb.com.br
Sending IP: 162.241.45.56
From: HSBC Advising Service <AdvicesMY@sc.com>
Subject: Payment Advice - Ref: HSBC99002992/28052020
Attachment: Pass code-HSBC Advising payment service_pdf.rar (contains "Pass code-HSBC Advising payment service_pdf.exe")

AgentTesla SMTP exfil server:
vps.amaranth-produkte.pw:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Malware.Kryptik
Create hunting rule
Status:
Suspicious
First seen:
2020-05-28 14:01:27 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
4 of 47 (8.51%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 58919103084b7a2ff2528f2b59ecc6b7a37e4f333270b891801ea7706cc1c517

(this sample)

AgentTesla

Executable exe bee5f2a67bb904418f1b5a819e2434f1a01824d485a04aab756fd279f05a35f3

  
Dropping
MD5 fcfd1fafb77f16e26cf7ce9d779be8c1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bee5f2a67bb904418f1b5a819e2434f1a01824d485a04aab756fd279f05a35f3

Comments