MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6591d04e5951b377a501d3b447bf8cb5a02c2660f5559dcc383556a6adca8452. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6591d04e5951b377a501d3b447bf8cb5a02c2660f5559dcc383556a6adca8452
SHA3-384 hash: 565f2b0108fc4f8d1145e73b204029912a1d38dd9f8670dd413218b4ee7fd1519e5d74ef351c04fd5c0919b01fbed902
SHA1 hash: f5df5a4ccf60035d0e17e60a2cd4b0b29b84217d
MD5 hash: ba8a91ba1fea5523b6e281df0c0a6288
humanhash: oranges-alanine-eight-four
File name:Purchase Order.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:883'238 bytes
First seen:2021-03-16 11:05:11 UTC
Last seen:2021-03-17 17:42:05 UTC
File type: rar
MIME type:application/x-rar
ssdeep 24576:1w1KocplQlpYVd0B5b0RaxHH380mPNboXJQzNAV47yK:yKoiylpYVdIdOax380PJXKb
TLSH 6F15235882539B205970BFDB93C05FAE501C79EFFEEF84E08646F9B640A262DB1503E5
Reporter cocaman
Tags:AgentTesla INVOICE rar


Avatar
cocaman
Malicious email (T1566.001)
From: "letempsmedia.ch IT Support <customersupport@cairohydraulic.com>" (likely spoofed)
Received: "from cairohydraulic.com (unknown [45.137.22.85]) "
Date: "17 Mar 2021 10:27:03 -0700"
Subject: "TOP URGENT ACTION REQUIRED!!"
Attachment: "Purchase Order.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6591d04e5951b377a501d3b447bf8cb5a02c2660f5559dcc383556a6adca8452/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-16 10:05:06 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mwi5atszkgzxpjib2o2epp4mwwqcyjta6vkz3tbygvlknlokqrja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6591d04e5951b377a501d3b447bf8cb5a02c2660f5559dcc383556a6adca8452

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6591d04e5951b377a501d3b447bf8cb5a02c2660f5559dcc383556a6adca8452

(this sample)

AgentTesla

Executable exe 967a472e4539ef32688416973d01dc37451955a08bd1efc06a9a711670728010

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 967a472e4539ef32688416973d01dc37451955a08bd1efc06a9a711670728010
  
Dropping
AgentTesla

Comments