MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e5da4877ca0d0379e66f8db985efcb0b0cbe8d2ea4c5f3f98c1aae1c68bed75. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e5da4877ca0d0379e66f8db985efcb0b0cbe8d2ea4c5f3f98c1aae1c68bed75
SHA3-384 hash: da34e4177bd78a0ac5353b21a72fe53a4e8bdb5786b85a8ff8c13c54b989cb8adb4f6ea6a7f6fb5e046fffbee0c6642a
SHA1 hash: 922c85691a062d682c8a15c4650febb61e7e430f
MD5 hash: 525c21bd2430e05ff6d5978eeb47a841
humanhash: comet-fruit-may-sink
File name:PURCHASE ORDER, LAMPIRIS.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:814'388 bytes
First seen:2020-05-13 06:08:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:RuYrDE2Ljl+3P/eVtuYrDE2Ljl+3P/eVi:RJM2LZseVtJM2LZseVi
TLSH B7052374D1AF051947B656D0BC0EA40FCCB286F72126B864DBEA60926361473E8EFF4D
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lampiris.be
Sending IP: 37.72.175.179
From: Louis Dupont - Lampiris <Louis.dupont@lampiris.be>
Reply-To: Louis Dupont - Lampiris <Louisdupont.lampiris@mail.com>
Subject: REQUEST FOR QUOTATION; Lampiris Company Belgium-374638
Attachment: PURCHASE ORDER, LAMPIRIS.rar (contains "PURCHASE ORDER, LAMPIRIS.exe")

AgentTesla SMTP exfil server:
mail.alvadiwipa.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 06:37:01 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nzo2jb34udidphtg7dnzqxx4wcymx2gs5jgf6p4yygvodrul5v2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6e5da4877ca0d0379e66f8db985efcb0b0cbe8d2ea4c5f3f98c1aae1c68bed75

(this sample)

AgentTesla

Executable exe 79707deb89afd6a88eaf63af7065b7e30d0508126cf6c8664d01a924dd60e4a5

  
Dropping
MD5 4b2295c05164879c1e7d48d10fa6d2fa
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 79707deb89afd6a88eaf63af7065b7e30d0508126cf6c8664d01a924dd60e4a5

Comments