MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33875f866460e2bfb19f9893dab65ceb36eb29266ab2dd08de31f9e23ca0d7cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33875f866460e2bfb19f9893dab65ceb36eb29266ab2dd08de31f9e23ca0d7cd
SHA3-384 hash: 698a1af560aefba5a55cc6b4b9798872908959a2a2224ec359c13bbfb1a1b0d9293fd46fecfbca27abdc3933794e63b8
SHA1 hash: 3ec3e15e6fee15b29d25346b83998b331e543002
MD5 hash: a42d9b5166827e8b19f0f38d64d86c78
humanhash: don-zebra-three-king
File name:Sat_Alma_Emri_6000000.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'488'320 bytes
First seen:2020-06-04 13:23:26 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:9aUDdu6VEt6YXsuDV+O0Q+2Gk7aiSu5euSESB0MX6rtqYuVh8qx6kP:hw6NYPV0Q+2BSu54lBDgwYstHP
TLSH 6FB54F27EC058657E02C03FDF8574DB56A2E6705B543ABFE61B60ECE2E0125A2E9703D
Reporter abuse_ch
Tags:AgentTesla geo img TUR


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.engrafik.com
Sending IP: 79.98.129.253
From: Göymen Demir Çelik İnş. Şarkı söyleme <ocavus@targim.com.tr>
Reply-To: redorange.110@jyzaustin.com
Subject: Re:Re:Re:satın alma emri
Attachment: Sat_Alma_Emri_6000000.img (contains "Sat_Alma_Emri_6000000.exe")

AgentTesla FTP exfil server:
ftp.lilangelness.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 02:47:00 UTC
AV detection:
14 of 31 (45.16%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=godv7btemdrl7mm7tcj5vns45m3owkjgnkzn2cg6gh46epfa27gq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 33875f866460e2bfb19f9893dab65ceb36eb29266ab2dd08de31f9e23ca0d7cd

(this sample)

AgentTesla

Executable exe 3ac44f96c1937f01a4a0f0a69d1a310a8e98e5a547fad95b38afcc4030af1646

  
Dropping
MD5 f0c93708667f00954236a2049d906ed8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3ac44f96c1937f01a4a0f0a69d1a310a8e98e5a547fad95b38afcc4030af1646

Comments