MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65783f55d1608b26a6f3d80491e37c1b80c73e5a9abf4cce34340abbe87dcd26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65783f55d1608b26a6f3d80491e37c1b80c73e5a9abf4cce34340abbe87dcd26
SHA3-384 hash: 763d59cfce457bfcffdd90516b3dce059891dc752e6bb9a017623d03908fec5ef7356ecf7071a3451fd6be6351fc32d5
SHA1 hash: 58d46b329e54b624c960eb531189d27f7593be9e
MD5 hash: 1f2c1eb2d9450f26d74b5cc2950f3980
humanhash: johnny-nineteen-mars-south
File name:Acil Siparis.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:661'504 bytes
First seen:2020-10-16 17:44:03 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:ERBvDd0TNebyjYaFL7gdHB5vqssEGGMjw5lQkm:ESTz7FL7gBTvqssErMjj
TLSH D4E47CBD6A44E52DED5E5D33C89038E9C12D7C670E8FF107A84729DCAD1E291DAB20B4
Reporter abuse_ch
Tags:AgentTesla geo img TUR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: playsoft.it
Sending IP: 212.35.197.96
From: Tuncay AYKAÇ <tuncayaykac@ditas.com.tr>
Subject: Acil Siparis Talebi
Attachment: Acil Siparis.img (contains "Acil Siparis.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.18972.11660.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/65783f55d1608b26a6f3d80491e37c1b80c73e5a9abf4cce34340abbe87dcd26/
Threat name:
ByteCode-MSIL.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 10:35:21 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mv4d6vormcfsnjxt3acjdy34doamops2tk7uztrugqflx2d5zuta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/65783f55d1608b26a6f3d80491e37c1b80c73e5a9abf4cce34340abbe87dcd26

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 65783f55d1608b26a6f3d80491e37c1b80c73e5a9abf4cce34340abbe87dcd26

(this sample)

AgentTesla

Executable exe 9e045207e83e937a185c2a2418b5582d75d5df52fe6fa54aae2630bc0447defd

  
Dropping
MD5 3e0a584332e0c90fd2cdf3032ec8e617
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9e045207e83e937a185c2a2418b5582d75d5df52fe6fa54aae2630bc0447defd

Comments