MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6b3a761a2e6c08a580d6505908c1c5bad073bd5b6de5e8343f8903eca876de7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6b3a761a2e6c08a580d6505908c1c5bad073bd5b6de5e8343f8903eca876de7
SHA3-384 hash: 27d03180dba09184eb7ad072b81fc94f11ba9fb41bf31143b420e4fe58da6dcb5a6bf62410f16605c0b515c7306671e9
SHA1 hash: d3897e5b46819b5f1d14fba90f47abc5874843be
MD5 hash: 530a164a99d72743fb4447303654971a
humanhash: nitrogen-jupiter-washington-spring
File name:Transaction execution confirmation.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:423'744 bytes
First seen:2020-05-20 11:43:06 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:PhuuyYjz9Aibttx7Ap8GKOVJZv4khgXY9+c03wmfgcEIqC:P1PjyMh7Ap8gR31b0g8REU
TLSH 759423F30E1BBC3F04495762AA5476DB5644A0B9D004A39A572EF3F4BA23C7DA782707
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pooh.calderra.com
Sending IP: 195.234.138.6
From: mBank S.A. <powiadomienia@mbank.pl>
Subject: mBank S.A. - transaction confirmation
Attachment: Transaction execution confirmation.rar (contains "Transaction execution confirmation.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 12:37:15 UTC
File Type:
Binary (Archive)
Extracted files:
274
AV detection:
14 of 48 (29.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=42z2oync43aiuwanmuczbda4lowqoo6vw3pf5a2d7cid5suhnxtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e6b3a761a2e6c08a580d6505908c1c5bad073bd5b6de5e8343f8903eca876de7

(this sample)

AgentTesla

Executable exe 757207b0f638a3e70800aaa7cb4eda7e207f3641158d4a789d50b231fbe4f136

  
Dropping
MD5 5780d7d1a7bd78c349370244835d2b5c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 757207b0f638a3e70800aaa7cb4eda7e207f3641158d4a789d50b231fbe4f136

Comments