MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77101fa95de5bf95ef731b51ddf2df9fe94dce55896116a0b0f2e95ea92bbb57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77101fa95de5bf95ef731b51ddf2df9fe94dce55896116a0b0f2e95ea92bbb57
SHA3-384 hash: afd474a17f07b4997a1353f6ba90f662e527ebee659acd895a6e6c33d57c75afaf0c24c9e51d2e41c068cd67e0ad7a5b
SHA1 hash: 376b69e4b39c20055b6cbdfaaac30bd0bf46ab52
MD5 hash: 5f97e9a60e4a4f886393ab1cf98be13c
humanhash: fifteen-river-idaho-nine
File name:dekont.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:676'328 bytes
First seen:2020-10-05 11:19:37 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:OoElZqTLcfxVXfKA2GhSxmepzWKKxWUcyKZ7ziS+5JLD:BElcLineWSxmszWKKcy+ziSm1D
TLSH DAE423C0D436C46097FCDE2D21B2DA039E07A381697A16C09BFEEFC21E4995DE4A45F5
Reporter abuse_ch
Tags:AgentTesla GarantiBBVA geo TUR xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.xooopuyt.ml
Sending IP: 78.40.219.90
From: Garanti Bankası <ekstre@garanti.com.tr>
Reply-To: noreply <noreply@garanti.com.tr>
Subject: Hesap hareketleriniz
Attachment: dekont.xz (contains "dekont.exe")

AgentTesla SMTP exfil server:
mail.forcemachine.net:587

AgentTesla SMTP exfil email address:
biz.mvltitrans@gmail.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/77101fa95de5bf95ef731b51ddf2df9fe94dce55896116a0b0f2e95ea92bbb57/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o4ib7kk54w7zl33tdni534w7t7uu3tsvrfqrnifq6luv5kjlxnlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/77101fa95de5bf95ef731b51ddf2df9fe94dce55896116a0b0f2e95ea92bbb57

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 77101fa95de5bf95ef731b51ddf2df9fe94dce55896116a0b0f2e95ea92bbb57

(this sample)

AgentTesla

Executable exe eed860fb0b48051582b2f34f20bc47f0fa5cd2273d20df99d339d1058e79113f

  
Dropping
MD5 3ed1c27e31b105e7d19e45626da43e0a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eed860fb0b48051582b2f34f20bc47f0fa5cd2273d20df99d339d1058e79113f

Comments