MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f2a85d87386099a310080f43dff69ba5d765addbb706d109cdcc619a75bc883. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f2a85d87386099a310080f43dff69ba5d765addbb706d109cdcc619a75bc883
SHA3-384 hash: 7401951854e34b05ef67339292757db742f4b18fac4e31baa680648e6620c180b2e264609e6ee3f6c98fcf925cc19812
SHA1 hash: 4484a50153b7fb5f73182f1f74d9a303d4cbf03b
MD5 hash: f49ab6cf336d87da767c83d08ca4912b
humanhash: low-glucose-bravo-cola
File name:Overdue Invoice..rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:390'615 bytes
First seen:2020-08-16 06:25:27 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:szJTeAgz+P34D6lQy3J2Ux39Ge19bHO9GDwoowqVmS6jCZsCSWCWrtS6lcRMEmxW:szjwDGQy3TxtGqFGrVIjCCCFCWAlidxW
TLSH A58423D169C0A3B4315C46EB7A6190D8B5AB479EBCACB28E5CF4C4C45FE1F822132F61
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.btjlines.com
Sending IP: 137.59.125.189
From: Givens & Johnstons <twalter@prevaillawyers.com>
Subject: Legal Actions Against Your Company.
Attachment: Overdue Invoice..rar (contains "Overdue Invoice..exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27121.RarHeur.NoDP.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f2a85d87386099a310080f43dff69ba5d765addbb706d109cdcc619a75bc883/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-16 06:27:06 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n4vilwdtqyezumiaqd2d373jxjoxmww5xnyg2ee43tdbtj23zcbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6f2a85d87386099a310080f43dff69ba5d765addbb706d109cdcc619a75bc883

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6f2a85d87386099a310080f43dff69ba5d765addbb706d109cdcc619a75bc883

(this sample)

AgentTesla

Executable exe c2384159db2fb98c982b2720d78622dab53020509d3889dfe91d8c3ba21e0e1c

  
Dropping
MD5 d22077565105641d02ca11a071f3dc1d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c2384159db2fb98c982b2720d78622dab53020509d3889dfe91d8c3ba21e0e1c

Comments