MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f128069c33456c56fb369e04ea875fed3d2336ae15919fc2070242a2edc2488. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f128069c33456c56fb369e04ea875fed3d2336ae15919fc2070242a2edc2488
SHA3-384 hash: 3d5d8e051508c1ebf26ce5b76ee110c2080029f46debfa86eb6e67de57780420f5a13ab6be3378557cf2f1ca8b862a79
SHA1 hash: d4f80c3606acf47a09200acff71efb26cc9e8334
MD5 hash: 61fb5a7b85bdfb46a4f8430ef38c2614
humanhash: virginia-east-angel-ack
File name:PoQRY25A9ylhfJQ.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-14 09:44:54 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:W9wayr5Y/d7Dx/9DxLfyosVNyFqtPly8owhtSbrkcny0b0I92BhZRf:yDxjyRVNTPl+qo4yyg792F
TLSH B845AE216684CA41E83D57B8D13505F003F77C66D732E94FBEA97EA93A736E1423360A
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail0.tradingssupplieers.org
Sending IP: 192.236.176.136
From: victim-domain <victim-email>
Subject: PoQRY25A9ylhfJQ
Attachment: PoQRY25A9ylhfJQ.img (contains "PoQRY25A9ylhfJQ.exe")

AgentTesla SMTP exfil server:

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f128069c33456c56fb369e04ea875fed3d2336ae15919fc2070242a2edc2488/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 09:46:06 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n4jia2odgrlmk35tnhqe5kdv73j5em3k4fmrt7baoasculw4esea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6f128069c33456c56fb369e04ea875fed3d2336ae15919fc2070242a2edc2488

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 6f128069c33456c56fb369e04ea875fed3d2336ae15919fc2070242a2edc2488

(this sample)

AgentTesla

Executable exe dd73e7c8d4f3014acf00b5e917cb126e4a25389d30c77549c67d9a20858baad0

  
Dropping
MD5 68f108339bbf394974fdc595699a91a8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dd73e7c8d4f3014acf00b5e917cb126e4a25389d30c77549c67d9a20858baad0

Comments