MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79139d566cf850f74d91fc83cea6e8414759115d1f2b4dcf4c37227dc31269c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79139d566cf850f74d91fc83cea6e8414759115d1f2b4dcf4c37227dc31269c6
SHA3-384 hash: d2d5cfb25dac077590789282c2c7d7781fc79165df1f93848555d3e6b027868ec04333ce3897e18576ca02aaeec61f55
SHA1 hash: e3171ff78bcb13e74daca2f20765018d2b95df18
MD5 hash: daa18dbd544d2250ab94da7d5d46360c
humanhash: montana-illinois-two-harry
File name:Miguel Miranda S.L OC 6570 2020.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:369'364 bytes
First seen:2020-07-06 15:04:17 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:PW/g0OqSMaEZZHYlaW7SQIFv6tbM7m1xMVZaW/Nij+z7uu316w1bw4kPF22xUlR5:e/jhSBEZZH+aWPIFS+7m1CVsQz7b/S49
TLSH 6F7423ECFEF99EE58787981CC4E458B4DA61D4546D3A5BF160CED030D48230DAA0FAB6
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: royalty.royalty.ro
Sending IP: 188.215.55.88
From: Lourdes Nieto <compras1@miguelmiranda.net>
Subject: RV: Orden de Compra Nº 6570
Attachment: Miguel Miranda S.L OC 6570 2020.r00 (contains "Orden de Compra Miguel Miranda S_L 6570.exe")

AgentTesla SMTP exfil server:
mail.corroshield.co.id:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79139d566cf850f74d91fc83cea6e8414759115d1f2b4dcf4c37227dc31269c6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 15:06:06 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pejz2vtm7bipotmr7sb45jxiifdvsek5d4vu3t2mg4rh3qysnhda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 79139d566cf850f74d91fc83cea6e8414759115d1f2b4dcf4c37227dc31269c6

(this sample)

AgentTesla

Executable exe 2e53d06f8ecf81841ca919413b23b6e6104adf2226a89625b5c84b204b4e4bc2

  
Dropping
MD5 a43187b2a5dc9bb0504f9a6c31d107a9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2e53d06f8ecf81841ca919413b23b6e6104adf2226a89625b5c84b204b4e4bc2

Comments