MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6791a2fce5025fd09c1278944d7d29480ac4325f0bc57823301ec2006b353dca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6791a2fce5025fd09c1278944d7d29480ac4325f0bc57823301ec2006b353dca
SHA3-384 hash: d16049f859f968ade73bc76a7d37e7d780d5b295a8cc4af13791eabbde0cd7233d43212b5b8fc5c1cf62845f21a8292b
SHA1 hash: aef76bbe30acfd70bbd71904b7ca6335971995a1
MD5 hash: c5aee633f8d833b9aa21233f9f98114d
humanhash: saturn-diet-early-finch
File name:purchase order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:367'482 bytes
First seen:2020-06-25 09:13:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:2Vawoo02eTOEks8DekpvX/wVMEhke3uRqKfY7rEwiMaN8sTBjwgimDk41Uyfi/Sh:Zwoo02eTOEfNwvoV5F3uDxwiMaN8sdjF
TLSH 877423EE6B176E5E4CD23366E3388B00EF7A43321B29652D59D03221CDC98D77C6D662
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: almoverseas.com
Sending IP: 172.93.189.91
From: purchasing<export@almoverseas.com>
Reply-To: purchasing<s.nsa41@hotmail.com>
Subject: purchase order
Attachment: purchase order.zip (contains "purchase order.exe")

AgentTesla SMTP exfil server:
premium71.web-hosting.com:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.20909.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6791a2fce5025fd09c1278944d7d29480ac4325f0bc57823301ec2006b353dca/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m6i2f7hfajp5bhaspcke27jjjafmims7bpcxqizqd3baa2zvhxfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6791a2fce5025fd09c1278944d7d29480ac4325f0bc57823301ec2006b353dca

(this sample)

AgentTesla

Executable exe a1d0c4b67f70957eb177330c4bac5fb51496f87b7be4e86580673a9e3442ad83

  
Dropping
MD5 76afd9d30095e38d0ac8b7a7c27e03e6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a1d0c4b67f70957eb177330c4bac5fb51496f87b7be4e86580673a9e3442ad83

Comments