MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cb2aac5524a46c2a394104d7b882b06f65ca95d62e39aa47f758e9708c4072c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6cb2aac5524a46c2a394104d7b882b06f65ca95d62e39aa47f758e9708c4072c
SHA3-384 hash: e047395d1b72c397cfef0d3a6ed9f8e114f5cf1970ef363eab82480fdeed0bf59c288e9703cc5988eb1d713c1d30aa46
SHA1 hash: cffc8bc3df7471a7b72323cbf14898987093b932
MD5 hash: 6cfd53e466cea9de8d510716bcf2641f
humanhash: crazy-purple-triple-white
File name:BOOKING 6x20 AGL.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:526'214 bytes
First seen:2020-05-21 10:36:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:2Ob6tWNHX0AgvFUZ1v6dKUiZaGcIZrndU3Watb1g/w6:2NWdPgvFUHv5UiYGHnMtb1g/w6
TLSH B4B423E446167A3104A15E3ECD388B010A274A8FCB36C5143D6295AC7EDFF19981EDEF
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.huclangia.gq
Sending IP: 64.52.173.52
From: Rojda Co. Ltd <sales@mahaveergroup.net>
Reply-To: saleslink@yandex.com
Subject: RE: BOOKING 6x20' AGL / MEPAS MERSIN ex. MUNDRA // 733
Attachment: BOOKING 6x20 AGL.pdf.z (contains "BOOKING 6x20' AGL.pdf.exe")

AgentTesla SMTP exfil server:
mail.ereglitso.org.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.LuheFihaB.2796.3075.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 11:36:56 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6cb2aac5524a46c2a394104d7b882b06f65ca95d62e39aa47f758e9708c4072c

(this sample)

AgentTesla

Executable exe 62433e4de86d61a56cfc3333382d8a43d666a4839415a88ceca53a0754e06636

  
Dropping
MD5 67d52644b5e58b57b81cddcd40bce613
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 62433e4de86d61a56cfc3333382d8a43d666a4839415a88ceca53a0754e06636

Comments