MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b005037ac6fb34dede8fdd53e2c4eb5ba347ab5a234e17843bbe7c8a11a6434. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b005037ac6fb34dede8fdd53e2c4eb5ba347ab5a234e17843bbe7c8a11a6434
SHA3-384 hash: 0c69ca2cdd4e665f5a28828c47e7345208d6a7058f558ff418b83b579c7861cf7939b97ba822b22a1deafbdf10f3a28e
SHA1 hash: e1ca0c567cc5b991f042850dccd595063877aee1
MD5 hash: bf4f64c5001eca31a5cea6d39214fe4f
humanhash: delaware-shade-foxtrot-eighteen
File name:Payment Slip.uue
Download: download sample
Signature AgentTesla
Create hunting rule
File size:540'511 bytes
First seen:2020-08-30 06:30:07 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 12288:2zuolgI34RmlgOmKMYTS03pkuTpKx9emgqpM0sz3:wuou64AlX9sKpKx9emgMMjj
TLSH EBB42365D30020FEDB2A2FB49F4C17C4959A2E6FE26CD1434A6E6B954AD8E257C230D3
Reporter abuse_ch
Tags:AgentTesla uue Yahoo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic312-23.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.191.204
From: Accounts <joehannah36@yahoo.com>
Reply-To: Accounts <joehannah36@yahoo.com>
Subject: Payment Slip
Attachment: Payment Slip.uue (contains "Payment Slip.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6b005037ac6fb34dede8fdd53e2c4eb5ba347ab5a234e17843bbe7c8a11a6434/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-29 11:15:27 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nmafan5mn6zu33pi7xkt4lcoww5di6vvui2oc6cdxpt4rii2mq2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6b005037ac6fb34dede8fdd53e2c4eb5ba347ab5a234e17843bbe7c8a11a6434

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

uue 6b005037ac6fb34dede8fdd53e2c4eb5ba347ab5a234e17843bbe7c8a11a6434

(this sample)

AgentTesla

Executable exe 8f8d3f5dd9c67c9a7828eb9ba2e86f33648abad381e5b32d45d1aef922cad1a1

  
Dropping
MD5 6ecb12de0ee5fd09192a0f30114cafac
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8f8d3f5dd9c67c9a7828eb9ba2e86f33648abad381e5b32d45d1aef922cad1a1

Comments