MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24956aa0137e2206668bb4361028b08d07b3a2d9a15f03fc3034ec7a8951bd9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24956aa0137e2206668bb4361028b08d07b3a2d9a15f03fc3034ec7a8951bd9a
SHA3-384 hash: 1e522953e5a615831d8cfcd416fa56c5936b5ee7e1d23d5012b95d7052d87e231d2cedb67fa71815df06cde54c478523
SHA1 hash: 0679c6cff58485eeb41a853d85565e9df1e37367
MD5 hash: b12ce58ab4f9c6c5497fc84145197f25
humanhash: delta-jig-solar-july
File name:Turkistanman OCT order Swift 40 deposit against order PO 277138293.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:587'940 bytes
First seen:2020-10-05 11:43:09 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 12288:NmGTx64s/EHRWztkRntU3mJKYtDVB6ovpwLl18aps9DxbjqHdnbgO:3dM/yRWztItio9DVQoxkfQdvqHREO
TLSH 26C4239286B9E564DC3CD2CAE46FE43BE366CE8C09E530D0F2B842A3995305D6B71536
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.ihszimbra18.com
Sending IP: 94.138.192.207
From: Yıldırım Ticaret <info@yildirimticaret.com>
Subject: Oct Turkistan Swift
Attachment: Turkistanman OCT order Swift 40 deposit against order PO 277138293.xz (contains "Turkistanman OCT order Swift 40 deposit against order PO 277138293.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/24956aa0137e2206668bb4361028b08d07b3a2d9a15f03fc3034ec7a8951bd9a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 07:41:09 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eskwviatpyramzulwq3bakfqrud3hiwzufpqh7bqgtwhvckrxwna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/24956aa0137e2206668bb4361028b08d07b3a2d9a15f03fc3034ec7a8951bd9a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz 24956aa0137e2206668bb4361028b08d07b3a2d9a15f03fc3034ec7a8951bd9a

(this sample)

AgentTesla

Executable exe b27e64df6a3791d23937cdc503aa9314770409a13dab6565b05570381cd71189

  
Dropping
MD5 bdbb479df705b1a6e1afd3b3b88bfd53
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b27e64df6a3791d23937cdc503aa9314770409a13dab6565b05570381cd71189

Comments