MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c43b208fb86ad3ffb57ca2ca2c0b95470b1f9dac6e8141554d010b1908d860b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c43b208fb86ad3ffb57ca2ca2c0b95470b1f9dac6e8141554d010b1908d860b
SHA3-384 hash: 742da5e96e69d229ac23f63d85434727bd81c27bfd8a1f49fc79efe12e50eac5b559fdbf297e8bfde16a76fa576e5bf8
SHA1 hash: b56d98d914aaa57137da09848824411dc0b2baf8
MD5 hash: 3079b72374f7018cd86431efe445d487
humanhash: lion-sierra-sodium-quebec
File name:file.pdf.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:487'492 bytes
First seen:2020-06-02 10:45:30 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:UvLKDux7YCa9ArwQDNdHuQmNV1mhzXBmZgujMyl:aWDuxRa9MwQLHudChzXEtt
TLSH 39A4239260D8C3D3D3E39F59FEB9F95ECFD7586512860A648672B02B9C2570084C7EA8
Reporter abuse_ch
Tags:AgentTesla arj geo GRC


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: b2.d6.net
Sending IP: 87.120.13.6
From: Petros Daras <stefanie@ronnykobo.com>
Subject: ΠΛΗΡΩΜΗ ΤΟΥ ΙΣΟΛΟΓΙΣΜΟΥ
Attachment: file.pdf.arj (contains "file.pdf.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Jdeawli
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 04:02:36 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nrb3ech3q2wt762xziwkfqfzkryld6o2y3ubifku2aildeenqyfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 6c43b208fb86ad3ffb57ca2ca2c0b95470b1f9dac6e8141554d010b1908d860b

(this sample)

AgentTesla

Executable exe c2844c31f6c4c01ed6f337d65c76a25af92c56a53fe693305214ce6aacf77036

  
Dropping
MD5 32fa9260f7ba55d33968ce49b6397e5d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c2844c31f6c4c01ed6f337d65c76a25af92c56a53fe693305214ce6aacf77036

Comments