MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a6ed5bee35d8303406637c387ffef2eb8b2526b91ed60fbbedf33a781e5b89b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a6ed5bee35d8303406637c387ffef2eb8b2526b91ed60fbbedf33a781e5b89b
SHA3-384 hash: a4c32a6352c7b731070150505d88efaebbaeeb08912394d5f71099d16e2566257a8c8405581ea6df312033612ec33694
SHA1 hash: f5b9e9901c194cda4e4cc85c1c6ca935d7fb62ca
MD5 hash: 8ab491b32d4e589ba6a202ca30f21852
humanhash: fruit-johnny-steak-potato
File name:PO 30014.lzh
Download: download sample
Signature AgentTesla
Create hunting rule
File size:960'569 bytes
First seen:2020-04-30 12:11:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:iBS+ec2dl+XQnjCNM4hjuJ5ZY/M5CWxeCvYqj8rBRnA+bl:cScXioutWM8FvrBJx
TLSH F4153387557AD7D346BB06493CAC32160D0BEAEE9A7642CE4E73DC01EFE3490B59107A
Reporter abuse_ch
Tags:AgentTesla lzh


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic302-20.consmr.mail.ir2.yahoo.com
Sending IP: 87.248.110.83
From: CAJA GROUP INC <amanda_johnson0101@yahoo.com>
Reply-To: CAJA GROUP INC <amanda_johnson0101@yahoo.com>
Subject: QUOTATION
Attachment: PO 30014.lzh (contains "PO 30014.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 10:38:23 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
16 of 47 (34.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=njxnlpxdlwbqgqdgg7byp77pf24leutlshwwb65634z2papfxcnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6a6ed5bee35d8303406637c387ffef2eb8b2526b91ed60fbbedf33a781e5b89b

(this sample)

AgentTesla

Executable exe a3b795b092c06721eff5f24422aa0589e5f96a61feca34995e1e764b74f9e930

  
Dropping
MD5 93cd0fa28cf645bac2789e2807e85f8c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a3b795b092c06721eff5f24422aa0589e5f96a61feca34995e1e764b74f9e930

Comments