MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a42f1605c5f912f7d3e49f8cdc3fbd90beb6af9dca781fc0edeaf3ddb9a0fc7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a42f1605c5f912f7d3e49f8cdc3fbd90beb6af9dca781fc0edeaf3ddb9a0fc7
SHA3-384 hash: 9a491ba93578a2aa55cd83aa0522c87789a6a68a00828b3a8f3ff4e66c754897b70c41b0cc4a7592485d73105a0681a7
SHA1 hash: e8b9fbbdecc21b5f46b8b028b695dc4c7247ba81
MD5 hash: fdd755784a2b19584507898c0dbef9bf
humanhash: alpha-thirteen-lake-snake
File name:PO 4110008466.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:419'851 bytes
First seen:2020-06-25 08:28:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:T3B8MXgba59T26SBlQp+7DftdTvN302mw1pumy+7cbxfgdmJFrjCTIb5Mhidz2x:TGMF0M+HftBvNB3umy+IbPFhOii
TLSH 48942357030594DC8980A2DA89E7F5C9908DC04DBEADC77A9864FBB915FC847B160EFC
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vm252s.diagonalhosting.com
Sending IP: 163.172.200.199
From: Ricardo Fernandes <rfernandes@lusavouga.pt>
Subject: RE: Nr. Offerta a Cliente. 20/00598 del 24/06/2020
Attachment: PO 4110008466.zip (contains "PO 4110008466.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.44022.26029.17820.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23627.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a42f1605c5f912f7d3e49f8cdc3fbd90beb6af9dca781fc0edeaf3ddb9a0fc7/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=njbpcyc4l6is67j6jh4m3q733ef6w2xz3styd7ao32xt3w42b7dq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6a42f1605c5f912f7d3e49f8cdc3fbd90beb6af9dca781fc0edeaf3ddb9a0fc7

(this sample)

AgentTesla

Executable exe 063985c69258d467865f4b77a36da0b357897d760764589523783d8d8680dc5f

  
Dropping
MD5 eef0c5317eea4780de01f3125bc462b4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 063985c69258d467865f4b77a36da0b357897d760764589523783d8d8680dc5f

Comments