MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c1c7b36a02acb4cb44a2a22ee80d6b3b653d2d0a59785ff829089ea85766b19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c1c7b36a02acb4cb44a2a22ee80d6b3b653d2d0a59785ff829089ea85766b19
SHA3-384 hash: e54a5f680081496f54588cb0547bb763958b20a1e9aa5bc31fec2026de7ae59e78d5e0d989dcff00bb877dbef65070a1
SHA1 hash: f3a2a62c6588e10d3fe40cfb0558c077a965673f
MD5 hash: 91ea3e6c52ba2fb75eac99e71f04ee07
humanhash: december-yellow-pip-virginia
File name:Facturas Pagadas al Vencimiento.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:559'133 bytes
First seen:2020-10-06 07:14:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:N3NrZ4MQG2JJ0Y5B9xgno3umqqx7glQHMtlt9h4RVd+AgfJ5YxL1Flfgz:VRy3GoH5BgnSsKzMbt34TO5YQz
TLSH E3C423B7BEC576D42E39D2281EC15A965F32690A5607B1AEFD0603DC9110FE08CBE5C7
Reporter abuse_ch
Tags:AgentTesla BBVA ESP geo rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: evo.pro-x-web.com
Sending IP: 78.46.63.50
From: Confirming.bbva@bbva.com
Reply-To: Confirming.bbva@bbva.com
Subject: BBVA-Confirming Facturas Pagadas al Vencimiento
Attachment: Facturas Pagadas al Vencimiento.rar (contains "Facturas Pagadas al Vencimiento.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c1c7b36a02acb4cb44a2a22ee80d6b3b653d2d0a59785ff829089ea85766b19/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 06:29:42 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nqohwnvaflfuznckfiro5agwwo3fhuwquwlyl74csce6vblwnmmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6c1c7b36a02acb4cb44a2a22ee80d6b3b653d2d0a59785ff829089ea85766b19

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6c1c7b36a02acb4cb44a2a22ee80d6b3b653d2d0a59785ff829089ea85766b19

(this sample)

AgentTesla

Executable exe 1aa81765895e9174878d9b0be9c15918062793b54f03ed6b088cf47dbcf2570b

  
Dropping
MD5 460551a9e549497ac9b253fad657c7e5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1aa81765895e9174878d9b0be9c15918062793b54f03ed6b088cf47dbcf2570b

Comments