MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6909358d9458e54d2989c060950a7bea5422d9c2ac75178db54e710707cc2fdf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6909358d9458e54d2989c060950a7bea5422d9c2ac75178db54e710707cc2fdf
SHA3-384 hash: f62001a4b74a4abce3131c93456676df9173df9891e447f129d031fd5a095096eb918ae12a7d913b859c62f5df3ffb64
SHA1 hash: 3c7248f010a6bd5b4ef1c83a6148b0ccf49a4979
MD5 hash: c894eac9f95527f5114e18f5d2bcb4a1
humanhash: romeo-autumn-cup-queen
File name:Quotation-Inv.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:517'569 bytes
First seen:2020-08-10 09:28:48 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:gkAOMNwQHVHJAJpN2pd94FdqVEX177BUunrakhz0+:gkAOQw6kpZF82X179UkaU7
TLSH 58B4234CB64353FC97319661F70B821D073DC3B55BFC88A2A95E93122D829ECED2662D
Reporter abuse_ch
Tags:AgentTesla Endurance rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 192-254-193-67.unifiedlayer.com
Sending IP: 192.254.193.67
From: Sales <info@kenzene.com>
Subject: Quotations for Drugs Requirement
Attachment: Quotation-Inv.rar (contains "Quotation-Inv.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6909358d9458e54d2989c060950a7bea5422d9c2ac75178db54e710707cc2fdf/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 09:30:11 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=neetldmuldsu2kmjybqjkct35jkcfwocvr2rpdnvjzyqob6mf7pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6909358d9458e54d2989c060950a7bea5422d9c2ac75178db54e710707cc2fdf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6909358d9458e54d2989c060950a7bea5422d9c2ac75178db54e710707cc2fdf

(this sample)

AgentTesla

Executable exe 4ab2e83b6bfd6b61c03b13f7b06806ccce7f3fdcc5c86dbd35295305b03f5d87

  
Dropping
MD5 9725680214b56a3ffefcbb3096535a36
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4ab2e83b6bfd6b61c03b13f7b06806ccce7f3fdcc5c86dbd35295305b03f5d87

Comments