MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06de4cc259e1fab7824ccc937c5ad00fc3f316fa6080c96f0e288470125e9eb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06de4cc259e1fab7824ccc937c5ad00fc3f316fa6080c96f0e288470125e9eb0
SHA3-384 hash: b05aeb96169ee56546cd96f46a57c820fe42e4b0d4ae2c94e3dead68c9f5c256577877cef87af4bc2cc71fe3914204e2
SHA1 hash: ad8420eac753106a7947fb49e4c3d523ba2411ef
MD5 hash: 8492e75da9e24f8f3a4d9f28decfcf57
humanhash: oklahoma-item-nevada-pizza
File name:Image001.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:470'958 bytes
First seen:2020-08-18 12:29:51 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:UgyLwn0lJsjetXPsww5fJOzUrIn+8dacCImwx/:Ug0h/tXPK5fsUrI+8lZX/
TLSH 6FA4236D2C3F0A54397998DF7B178C0132429E07712BE7606A624D3A7FB4D8A82AF15D
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: belhasajoinery.com
Sending IP: 185.222.57.165
From: Purchase <purchase@belhasajoinery.com>
Subject: Re: Transfer
Attachment: Image001.gz (contains "Image001.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/06de4cc259e1fab7824ccc937c5ad00fc3f316fa6080c96f0e288470125e9eb0/
Threat name:
Win32.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 04:23:29 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a3pezqsz4h5lpasmzsjxywwqb7b7gfx2mcams3yofcchaes6t2ya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/06de4cc259e1fab7824ccc937c5ad00fc3f316fa6080c96f0e288470125e9eb0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 06de4cc259e1fab7824ccc937c5ad00fc3f316fa6080c96f0e288470125e9eb0

(this sample)

AgentTesla

Executable exe e3278b1debb150da3621ab0790c55b5ff5077a815b738c7ca8e89c5ba48dab06

  
Dropping
MD5 029cd9bc58901534bff1824b73ee9c5e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e3278b1debb150da3621ab0790c55b5ff5077a815b738c7ca8e89c5ba48dab06

Comments