MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61471a587d88347187764d53f4b5cfcf85d33af390c9f3334aeeec736c87eec9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61471a587d88347187764d53f4b5cfcf85d33af390c9f3334aeeec736c87eec9
SHA3-384 hash: 5bf670288a28144be1b59ee74ee0b657c61c63f2a03b7ecd9a743a5303001fd1a5e59b2fe3145ceabf91d2e8d831ab1e
SHA1 hash: 516a676c0cc47426544052b040de20e0f46357a7
MD5 hash: a9f8a18143844b79135a23fba47ba914
humanhash: steak-pennsylvania-apart-winter
File name:SHIPPING DOCS.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:769'408 bytes
First seen:2020-08-31 11:04:38 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:jfNYK6EAG4Z8NnQ/vWZ5vUbMlPP5Ug0OHXK4X02Ury6Ete:+KlNJ8+gYBPaghH6Pyl8
TLSH B9F43375714863F00F36BB77165283B7AF53904582C62D8AD7E23987236F78A06ED90E
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bestservices.com.cn
Sending IP: 180.214.236.50
From: Evelyn Jin / BSI-SHA<ovs8.sha@bestservices.com.cn>
Subject: RE: FINAL SHIPPING DOCS.
Attachment: SHIPPING DOCS.rar (contains "SHIPPING DOCS.exe")

AgentTesla SMTP exfil server:
mail.varda.com.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61471a587d88347187764d53f4b5cfcf85d33af390c9f3334aeeec736c87eec9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 04:12:13 UTC
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mfdruwd5ra2hdb3wjvj7jnopz6c5goxtsde7gm2k53whg3eh53eq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/61471a587d88347187764d53f4b5cfcf85d33af390c9f3334aeeec736c87eec9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 61471a587d88347187764d53f4b5cfcf85d33af390c9f3334aeeec736c87eec9

(this sample)

AgentTesla

Executable exe 36c63120981769bc6a508edf5da75eae9504ab5a1ffa0fe8d9032ed9b8c124e2

  
Dropping
MD5 ed941bf2c0d2145229ce8f9c24ef9069
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 36c63120981769bc6a508edf5da75eae9504ab5a1ffa0fe8d9032ed9b8c124e2

Comments