MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6a835b07460b57ecac289d9f18d2e0f87b4a0e2da12df8f4211923100d35ed2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6a835b07460b57ecac289d9f18d2e0f87b4a0e2da12df8f4211923100d35ed2
SHA3-384 hash: dae01a78f37ac2faccfbba44bfee0bfe5db797b817c7d1f6bde578e6fb8d160fb43285a88cc4229dd57ebc83b65e462a
SHA1 hash: ac4596cc57c836c8ce710ae57759472888de95cd
MD5 hash: 42f774c4da361b8ae7f8316468ce54ff
humanhash: ceiling-angel-utah-pip
File name:pro-forma invoice.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:378'456 bytes
First seen:2020-06-30 08:46:25 UTC
Last seen:2020-06-30 10:33:53 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:Pf/utlyAQ6ZOitAujys9u/3EeyIFB8UyLg4MflzTTIWfV6cjzW518KsaOs:XG5OkAKyX/0eyaPyLafl3TIWfV66W5QQ
TLSH BF8423D085EC407559F113229A77450B02BDFD981CAA899F629317A830BFE07A7923EF
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: samisec.com
Sending IP: 78.157.221.238
From: Accounts<sav@samisec.com>
Reply-To: Accounts<s.nsa41@hotmail.com>
Subject: pro-forma inv
Attachment: pro-forma invoice.zip (contains "pro-forma invoice.exe")

AgentTesla SMTP exfil server:
business41.web-hosting.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.441166bc629c6bce.10326.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6a835b07460b57ecac289d9f18d2e0f87b4a0e2da12df8f4211923100d35ed2/
Threat name:
ByteCode-MSIL.Worm.AutoRun
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 08:48:05 UTC
AV detection:
20 of 46 (43.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=22udlmdumc2x5swcrhm7ddjob6d3jihc3ijn7d2ccgjdcagtl3ja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d6a835b07460b57ecac289d9f18d2e0f87b4a0e2da12df8f4211923100d35ed2

(this sample)

AgentTesla

Executable exe a9f98038cac91d7d9f92301d7738f9187fdc1a879aa9db3373ce1fbe1bbd6eae

  
Dropping
MD5 441166bc629c6bceb309d8004e21ded4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a9f98038cac91d7d9f92301d7738f9187fdc1a879aa9db3373ce1fbe1bbd6eae

Comments