MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61ea22a1efb20a565e3c6c29db49a175536a664af96aa2533045103acb0a6461. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61ea22a1efb20a565e3c6c29db49a175536a664af96aa2533045103acb0a6461
SHA3-384 hash: b0ffa6263df930f92c21699ac4b88fe871ce7ccb28ed9a05f053860bd07dd97cad20c67fa25db5316fba8e0efb8d7c89
SHA1 hash: fcfe85cf682c2f4c89ba73d10d89e1fb0ea949c2
MD5 hash: 95ef52a8bcfa030221e3f9783e0a3c09
humanhash: arkansas-idaho-lemon-nine
File name:AWB-2273692792.198736389_TR.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:570'270 bytes
First seen:2020-10-16 13:44:16 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:WAb3XHNI6oEZCUQZK+6pwPZrfWaacDnHOUmyqmT4FTc3SfGUTQV:WAbHPo9UL+bPpzdnHOUDq2Ac3vUo
TLSH F9C423C26D5D574ADAF0E2456F0D81E7D438BB9AB6F09C995C940F5FFFC18A888D8220
Reporter abuse_ch
Tags:AgentTesla geo rar TUR


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.cambrapropietat.net
Sending IP: 213.96.212.75
From: Başak KOÇYİĞİT <basakocyigit@thy.com>
Subject: Hava yolu faturası
Attachment: AWB-2273692792.198736389_TR.rar (contains "AWB-2273692792.198736389_TR.exe")

AgentTesla SMTP exfil server:
mail.jjfconsultores.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61ea22a1efb20a565e3c6c29db49a175536a664af96aa2533045103acb0a6461/
Threat name:
Win32.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 11:25:31 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mhvcfippwiffmxr4nqu5wsnbovjwuzsk7fvkeuzqiuidvsykmrqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/61ea22a1efb20a565e3c6c29db49a175536a664af96aa2533045103acb0a6461

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 61ea22a1efb20a565e3c6c29db49a175536a664af96aa2533045103acb0a6461

(this sample)

AgentTesla

Executable exe 903ec47443d43603328e58ddd1185ff9a60472e61cb039ad3e5b298a841ff6f3

  
Dropping
MD5 04c5c6b63396f7b84e337edbd7520aa4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 903ec47443d43603328e58ddd1185ff9a60472e61cb039ad3e5b298a841ff6f3

Comments