MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e6c4c540a7f1d41a853f16087693d3d47304f973c9880780994c8d45e173517. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e6c4c540a7f1d41a853f16087693d3d47304f973c9880780994c8d45e173517
SHA3-384 hash: 74ac0e36346cd136e9fbe092f3494130ff086b346d5122cbab6a165dd7368e3e925f9add340ba7e5d5f41decf4a057dd
SHA1 hash: 47760db5d0c45a5c480a34f6db676cfa8c8bfcba
MD5 hash: 1d72f4c8aa9d006b8fe653ff4c700ada
humanhash: diet-mars-whiskey-vegan
File name:payment_invoice_pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:479'232 bytes
First seen:2020-06-29 06:48:23 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:jT3YMastRGGyGR3zMRR5OzS1ShY2/AwCkzOHDNL6G1jRpQ5hlDMwb4T7Id+wpn:XYMgGyGR67OzS0LEUkjY5bM044d+wpn
TLSH 8EA4F198325076AFDC5B86799C959CB427202DA3531BD36394CB28DFEB1EB52CF001A7
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail0.614.xianwongleepxc.casa
Sending IP: 134.122.58.236
From: Shabeer M. T <shabeermt@lamco.ae>
Subject: Re: Payment Assistance Due To Covid-19 Pandemic
Attachment: payment_invoice_pdf.img (contains "payment_invoice_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e6c4c540a7f1d41a853f16087693d3d47304f973c9880780994c8d45e173517/
Threat name:
Win32.Trojan.Bluteal
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 06:50:08 UTC
AV detection:
14 of 31 (45.16%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nzweyvakp4oudkct6fqio2j5hvdtat4xhsmia6ajstenixqxgulq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 6e6c4c540a7f1d41a853f16087693d3d47304f973c9880780994c8d45e173517

(this sample)

AgentTesla

Executable exe ebafd522dd2fe21bc8a69b5b1293e8aefeaa21cedb1c4b75a1682cf0ca3bed2d

  
Dropping
MD5 eb3a8945a9acca393769f1df3a860006
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ebafd522dd2fe21bc8a69b5b1293e8aefeaa21cedb1c4b75a1682cf0ca3bed2d

Comments