MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b5329d03975cb323b679cab34f86c7aab8ac55a9d391dd48102cb420e3af506. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b5329d03975cb323b679cab34f86c7aab8ac55a9d391dd48102cb420e3af506
SHA3-384 hash: 900261ec81e1b8b0c6a5d3c6c51781a726690eaf90f0f9f8bbb8905b4c3909c41e7b1a74f8977343ea5fa8558f31d56e
SHA1 hash: a5cd5380f4f4150f76fb02c5b3675d275bb999e1
MD5 hash: 0c9ee840cb60e55d2466b097ee7235f1
humanhash: lactose-pluto-stairway-sodium
File name:RFQ.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:356'810 bytes
First seen:2020-07-09 06:27:15 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:vOmrVC0FTs7cXSTSP4Kypl+D9ys3CXY0FYWau3wmy3qGTDO:vOmo0FQ7cXS/BsOdFWu3wfW
TLSH EC7423AEAEE79BE39D104218D1353296135C6E833DD4D3946919220CF3938F91B3A7F6
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: friomarperu.com
Sending IP: 37.49.224.74
From: Anita Luis <comercial1@friomarperu.com>
Subject: RFQ 2097631
Attachment: RFQ.rar (contains "RFQ.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6b5329d03975cb323b679cab34f86c7aab8ac55a9d391dd48102cb420e3af506/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 06:29:05 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nnjstubzoxfteo3htsvtj6dmpkvyvrk2tu4r3vebalfuedr26uda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6b5329d03975cb323b679cab34f86c7aab8ac55a9d391dd48102cb420e3af506

(this sample)

AgentTesla

Executable exe 238788e74cb6c3236215f14bced5cfb01458fdd84a924d615f54a597db2f8f27

  
Dropping
MD5 5e6dbf9a72d11baea82e8a72d7dc04b7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 238788e74cb6c3236215f14bced5cfb01458fdd84a924d615f54a597db2f8f27

Comments