MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 106e10c5ee0801918db0a9cfb5a07a74259c497d44e2e7b8dfdd0ea968b24703. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 106e10c5ee0801918db0a9cfb5a07a74259c497d44e2e7b8dfdd0ea968b24703
SHA3-384 hash: abe7efc32764e30a832d4c24be67bfe8bc1d7554b65884b5536c4394c4df6e798ee115eb534a63bedfa7704cd9ac29d4
SHA1 hash: 3bfad9841ec824fd40d1be23f9f7a1daa819611b
MD5 hash: 7404f5c6c11da139922d262610bc5bde
humanhash: texas-equal-lactose-eight
File name:Shipping Documents.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:427'243 bytes
First seen:2020-11-25 11:56:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:imk+cpzfBgnKoTqfsC9WCFjZg0mmPt5IDqLvWpv+7:imk+cprBgnBTqkYvLRQwus7
TLSH EA942355D330A50B5C1006B8D30CFE3DA5742B4AF798D59021B5AB6EC2706BCAC9FAE8
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Dhl Express <dhl@eorange.shop>" (likely spoofed)
Received: "from 173-231-57-42.hosted.static.webnx.com (unknown [173.231.57.42]) "
Date: "Wed, 25 Nov 2020 16:08:39 +0600"
Subject: "SHIPPING ADDRESS CONFIRMATION"
Attachment: "Shipping Documents.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/106e10c5ee0801918db0a9cfb5a07a74259c497d44e2e7b8dfdd0ea968b24703/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-11-25 11:05:29 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cbxbbrpobaazddnqvhh3lid2oqszysl5itropog73uhks2fsi4bq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/106e10c5ee0801918db0a9cfb5a07a74259c497d44e2e7b8dfdd0ea968b24703

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 106e10c5ee0801918db0a9cfb5a07a74259c497d44e2e7b8dfdd0ea968b24703

(this sample)

AgentTesla

Executable exe fa4d2ff6d00bc311d0cd41fcacae2e183b6fc7c9344b9d4efc60e0654875fa25

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fa4d2ff6d00bc311d0cd41fcacae2e183b6fc7c9344b9d4efc60e0654875fa25
  
Dropping
AgentTesla

Comments