MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45af1ed78c0ef956acd8fdc746d9073eb4bca985206e8734dee93d1a97537f56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45af1ed78c0ef956acd8fdc746d9073eb4bca985206e8734dee93d1a97537f56
SHA3-384 hash: 59666794cf9f74ccfca26ce7a5b0bbbe50966ec7f787c52111528e1204f0d6dd2e67b2d0b85e58eeecdce9bfafc4e88b
SHA1 hash: ba552cc4ad4f7feaff729cdbf329337f8e98625c
MD5 hash: 26b2559e9fd5193b1a275cb7b4394528
humanhash: autumn-uranus-tango-yellow
File name:hesaphareket, txt.lha
Download: download sample
Signature AgentTesla
Create hunting rule
File size:770'904 bytes
First seen:2020-11-18 12:11:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:6cV2oMSPuvEt/mHdKEbfHEZmIPHOqnEVeeul7+gB57A7/rnElyGO0Mh7T7lJmQfD:BVeH8dmgIym/eEVLiCg/7e/rnYyGa7TT
TLSH C5F423162733A67B0454563EC3C79F1C5EFA8E6A0ACA0959E1E95CE1888246CCFC1F5F
Reporter abuse_ch
Tags:AgentTesla GarantiBBVA geo lha TUR


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: info.haberis.org.tr
Sending IP: 185.33.234.169
From: Garanti BBVA <ekstre@garanti.com.tr>
Reply-To: noreply@garanti.com.tr, noreply@garantibbva.com.tr
Subject: 18.11.2020 - 18.11.2020 arasindaki hesap hareketleriniz
Attachment: hesaphareket, txt.lha (contains "hesaphareket, txt.lha.exe")

AgentTesla SMTP exfil server:
mail.polimeter.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45af1ed78c0ef956acd8fdc746d9073eb4bca985206e8734dee93d1a97537f56/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iwxr5v4mb34vnlgy7xdunwihh22lzkmfebxiong65e6rvf2tp5la._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 45af1ed78c0ef956acd8fdc746d9073eb4bca985206e8734dee93d1a97537f56

(this sample)

AgentTesla

Executable exe b39379ebe05246822743fa8343c14aa40d04c0496dbd43c666e5de7f8af4eb71

  
Dropping
MD5 f0ef53567b9f82e76f3ab59237ca3a75
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b39379ebe05246822743fa8343c14aa40d04c0496dbd43c666e5de7f8af4eb71

Comments