MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77ad355120b6b70b8d9b3ff2638fe0bee9f941242519d81aeb1f71a53d17470d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77ad355120b6b70b8d9b3ff2638fe0bee9f941242519d81aeb1f71a53d17470d
SHA3-384 hash: e688afc6ab1a060b470b794d5f2528bd1501f1e32a00fa700c39267045aec639e9a02458a2acf81756aa9ea103dc4dcc
SHA1 hash: c15dd53b42d42e33f0c0d4372b574066c751bed7
MD5 hash: 5a48812ecdde2d3ee35e0ba8d5b363b4
humanhash: mountain-jersey-minnesota-equal
File name:AKBANK, MT 103 SWIFT ODEME EMRI-USD-78,000.00.lzh
Download: download sample
Signature AgentTesla
Create hunting rule
File size:838'730 bytes
First seen:2021-02-24 07:04:16 UTC
Last seen:2021-02-26 03:29:47 UTC
File type: lzh
MIME type:application/x-lzh-compressed
ssdeep 24576:DBVo0LbCFvATEobItlGb+4X4vtqGdPDArUBCxj4JcaAp:DnCYEo0t3QJSuUBy9
TLSH C305339588D74FCBEF8792BBD1418B9265E1B516F790E0438A96C193F3269CB1EA3070
Reporter abuse_ch
Tags:AgentTesla Akbank geo lzh TUR


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: akbank.com
Sending IP: 103.151.122.27
From: "Ahmet Tuğçe" <bizeulasin2@akbank.com>
Subject: AKBANK, SWIFT ODEME EMRI-USD-78,000.00 MT 103-SINGLE CUSTOMER CREDIT TRANSFER
Attachment: AKBANK, MT 103 SWIFT ODEME EMRI-USD-78,000.00.lzh (contains "AKBANK, MT 103 SWIFT ODEME EMRI-USD-78,000.00..exe")

AgentTesla SMTP exfil server:
server122.web-hosting.com:587

Intelligence

File Origin
# of uploads :
4
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42850.3012.31044.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/77ad355120b6b70b8d9b3ff2638fe0bee9f941242519d81aeb1f71a53d17470d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 03:00:00 UTC
AV detection:
7 of 47 (14.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o6wtkujaw23qxdm3h7zghd7ax3u7sqjeeum5qgxld5y2kpixi4gq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/77ad355120b6b70b8d9b3ff2638fe0bee9f941242519d81aeb1f71a53d17470d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

lzh 77ad355120b6b70b8d9b3ff2638fe0bee9f941242519d81aeb1f71a53d17470d

(this sample)

AgentTesla

Executable exe 34b8598fe95c5cb429075ef2fe2f9246da1f9009a8fe5e735ed6f415ce2e9526

  
Dropping
MD5 026e5f23dbbca02bf5c2432796016323
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 34b8598fe95c5cb429075ef2fe2f9246da1f9009a8fe5e735ed6f415ce2e9526

Comments