MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a3d33824d3d0553a6decd39b214ef32c7a26861ec25078c586dfbea3054b0cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a3d33824d3d0553a6decd39b214ef32c7a26861ec25078c586dfbea3054b0cb
SHA3-384 hash: 81dbe7ea0b59ba97934d445258c841a578e00bcb28a93870841bc5af7f954bd77931f91052133bb0da1bc3e1dc2bcb53
SHA1 hash: 91a102c73a04ecd486d047d9da2ad6e6adaf71b9
MD5 hash: b728e39e935b3d748f196b215272bb90
humanhash: saturn-winter-cup-eight
File name:PO_9671-19.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:415'343 bytes
First seen:2020-06-17 10:08:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:YqE+F39pxvHSAN8x+5Xqq5xdxllibHydDKSZ:Y49nvHSANY+hZ5fA4DK8
TLSH 839423CD83CADC754E502C5BE8A9AC345D40DE8A9B7ADD0C061A8E171DCDD253B5B3B2
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.mosonass.tk
Sending IP: 45.147.162.59
From: David Cooper <admin@mosonass.tk>
Subject: Order List 9671-19
Attachment: PO_9671-19.zip (contains "PO_9671-19.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FakeAlert.9060.1798.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 10:37:08 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ni6thasnhucvhjw6zu43efhpgld2e2db5qsqpdcynx56umcuwdfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6a3d33824d3d0553a6decd39b214ef32c7a26861ec25078c586dfbea3054b0cb

(this sample)

AgentTesla

Executable exe b296a0c1f44e996930b55fe6520b57fe61344ffe21a90cbf74d3bb85107871c9

  
Dropping
MD5 1bcb8899f4f8a388c05790b6a300aa5e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b296a0c1f44e996930b55fe6520b57fe61344ffe21a90cbf74d3bb85107871c9

Comments