MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b2a685def418da9584a44084f68624519f2dab5fd6f36b73f63e7d1304e9d65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b2a685def418da9584a44084f68624519f2dab5fd6f36b73f63e7d1304e9d65
SHA3-384 hash: aec82cd3a1e540befc373256b4d88be173f36ffe03cc80fd6728070ce8d9948b3581a7f7ae2a7d3ed480996205d4b632
SHA1 hash: 33e0e0e6bddbc6623849672071e50ae05f6c3ef5
MD5 hash: 349eb21119ed5b18c1440491e489b507
humanhash: solar-hot-nebraska-vermont
File name:Facturas Pagadas al Vencimiento.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:555'361 bytes
First seen:2020-10-06 06:28:48 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:rl8+bQ5tKo0KgqM7q2bWxLGG5PRObgAB7Sj5JfMLeCl:G+8d9gn77835PRzAB7Sj5RMtl
TLSH 87C4239CC063236EE5D70E24FF3F9968D93F77B59A80027884240DDB15E1EA9583BD85
Reporter abuse_ch
Tags:AgentTesla BBVA ESP geo rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: Confirming.bbva@bbva.com
Subject: BBVA-Confirming Facturas Pagadas al Vencimiento
Attachment: Facturas Pagadas al Vencimiento.rar (contains "Facturas Pagadas al Vencimiento.exe")

AgentTesla SMTP exfil server:
mail.gascuenca.es:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5b2a685def418da9584a44084f68624519f2dab5fd6f36b73f63e7d1304e9d65/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 05:17:00 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lmvgqxppigg2swckiqee62dcium7fwvv7vxtnnz7mpt5cmcotvsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5b2a685def418da9584a44084f68624519f2dab5fd6f36b73f63e7d1304e9d65

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5b2a685def418da9584a44084f68624519f2dab5fd6f36b73f63e7d1304e9d65

(this sample)

AgentTesla

Executable exe 59bbe3f3c9d04d180126b1396dcda25f533a491a92255ffdfca4acb6a6ca7bfa

  
Dropping
MD5 f6c71b6ee2820f9774d8a02aa3dac876
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 59bbe3f3c9d04d180126b1396dcda25f533a491a92255ffdfca4acb6a6ca7bfa

Comments