MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca83ae1608c56e81aed4f9a54c77e4ea5bff19815197333554dbc3758579861a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca83ae1608c56e81aed4f9a54c77e4ea5bff19815197333554dbc3758579861a
SHA3-384 hash: 0edcb05c2bd293e9dfbec540d3c52766700e8e1b6cac9ff0bf329f1df98cea23ce79883d3e07713cef20465dbfcbff08
SHA1 hash: c72f97f4d48921e44ff851c922dd9bd79045c9a1
MD5 hash: b1242d42f91042b85eff1cf77c45914f
humanhash: stairway-beer-yankee-happy
File name:Aviso de factura.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:303'471 bytes
First seen:2020-11-18 12:33:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:gy8Y/I8X7PVHRLGR7cfFj68/u15IetIXCFRHs0fJ+h0l7NY:gy8Y/I8LVW7i68/uDI2Fds0x+h0lK
TLSH AF54231220D93AE4E75C1C97846399D1A6E5689462F1EA43D4FE73A0D2C377EC60CF2E
Reporter abuse_ch
Tags:AgentTesla ESP geo rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: delivery.mailspamprotection.com
Sending IP: 146.66.121.62
From: Hunglo Global Trading Company LLC <production@estellanatura.com>
Subject: Re: Factura FNR Comercialización
Attachment: Aviso de factura.rar (contains "Aviso de factura.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca83ae1608c56e81aed4f9a54c77e4ea5bff19815197333554dbc3758579861a/
Threat name:
Win32.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 12:34:06 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zkb24fqiyvxidlwu7gsuy57e5jn76gmbkgltgnku3pbxlblzqyna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ca83ae1608c56e81aed4f9a54c77e4ea5bff19815197333554dbc3758579861a

(this sample)

AgentTesla

Executable exe 98ab07d2d8ef625b7e18ce21bc66c0a2ebdb9ee4ccac0982f70682d73fc3f124

  
Dropping
MD5 3e7752abf131554c1aafa6019e53df88
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 98ab07d2d8ef625b7e18ce21bc66c0a2ebdb9ee4ccac0982f70682d73fc3f124

Comments