MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61b10a8d89cf78e1f8872d17ddf0773a2306181448e53908668532fe17ba7fdf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61b10a8d89cf78e1f8872d17ddf0773a2306181448e53908668532fe17ba7fdf
SHA3-384 hash: 02fda145c05c0558670aff796236a28b8da606d9a74941fc88a1e29a5101820658380a25753d26935cbe7654773fec0e
SHA1 hash: 6f1ab976a4cbd3d72007f44885494cd2dd77cfa2
MD5 hash: 09e1910a12224a2caccd2b8b780fd5f0
humanhash: mexico-charlie-quebec-carpet
File name:HK Shipping docs.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:479'213 bytes
First seen:2020-08-06 05:41:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:i01WCaq8Z8dwMCGtlWj53U1iWrQT3AkOFpJnhaC8m0dVSiy/+kKoGLsc5kHA7VSx:ps8CojtyEs1QlpNhGdVHy/1angNN
TLSH 52A423A949B39DEF8B645D2B794F85D9C3F7038AA7392F35BC704059C258587800EB31
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: GWA5.newtekwebhosting.com
Sending IP: 63.134.207.24
From: twarner@llaltd.com
Subject: Documents for Containers TCKU2732871 & TEMU0034310
Attachment: HK Shipping docs.rar (contains "HK Shipping docs.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61b10a8d89cf78e1f8872d17ddf0773a2306181448e53908668532fe17ba7fdf/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:43:04 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mgyqvdmjz54od6ehful534dxhirqmgaujdstscdgquzp4f52p7pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/61b10a8d89cf78e1f8872d17ddf0773a2306181448e53908668532fe17ba7fdf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 61b10a8d89cf78e1f8872d17ddf0773a2306181448e53908668532fe17ba7fdf

(this sample)

AgentTesla

Executable exe 61d9ac86c9e84f051340bf2adedaa4eb4fc7960e01f8a00d66d2ebd4201489e2

  
Dropping
MD5 d92cf815874fb5fdeaef3f9963517d49
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 61d9ac86c9e84f051340bf2adedaa4eb4fc7960e01f8a00d66d2ebd4201489e2

Comments