MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 afda34efb261f97d2683bcd20931d9b18c7b8befdf8ff00b04a911da35e5c422. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: afda34efb261f97d2683bcd20931d9b18c7b8befdf8ff00b04a911da35e5c422
SHA3-384 hash: aa73916fe1679b7f01c689b0276838d916e61d061ebae870cb5f48554d1497923f08d95e6ee5ddb28b3d4b286a839982
SHA1 hash: dd978641dd14628e409535f17e6710ae66ea2fcb
MD5 hash: afac8401b8cebef10f1965885aa3b66f
humanhash: wolfram-nine-east-friend
File name:Facturas Pagadas al Vencimiento.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:436'167 bytes
First seen:2020-07-06 11:34:52 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:CQekZShxgnzBppv5ZwRvvACn28K4o96kKKDeDV7xLm/9V9Rf:CQeBU97R+RvRo9W76/hRf
TLSH 489423A7F1E5F75760BB9F4F18F622CB8741723486847E5D200B10B16F67396A0B0E9A
Reporter abuse_ch
Tags:AgentTesla BBVA ESP geo rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: CEN-YCO-Rutalia-001.hispaweb.net
Sending IP: 109.70.131.172
From: Confirming.bbva@bbva.com
Subject: BBVA-Confirming Facturas Pagadas al Vencimiento
Attachment: Facturas Pagadas al Vencimiento.rar (contains "Facturas Pagadas al Vencimiento.exe")

AgentTesla SMTP exfil server:
mail.gascuenca.es:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/afda34efb261f97d2683bcd20931d9b18c7b8befdf8ff00b04a911da35e5c422/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 11:35:26 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v7ndj35smh4x2judxtjasmozwgghxc7p36h7acyevei5unpfyqra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar afda34efb261f97d2683bcd20931d9b18c7b8befdf8ff00b04a911da35e5c422

(this sample)

AgentTesla

Executable exe ab0f5715fad3f2bf2ab19ecb92df974bed70e0d6f4d37a2fccd4649b94d0365c

  
Dropping
MD5 9f073e6d4a2e9b1046211a705d602ac4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ab0f5715fad3f2bf2ab19ecb92df974bed70e0d6f4d37a2fccd4649b94d0365c

Comments