MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6997aba6d03102e0b25f8051bb7cbfd1730fa5a5b437108ff6ce17e7d66794af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6997aba6d03102e0b25f8051bb7cbfd1730fa5a5b437108ff6ce17e7d66794af
SHA3-384 hash: 2580e6bf553c6d4be29202eeb5c4f7608b3189a618ed6181636bb18fa056770ac2f96dc42a468a7d18c1bda829bdb17b
SHA1 hash: 7505b0e06ab3349e793f84217ee8468782971b85
MD5 hash: 8a558e6ff28c2340701b4690c92cbdbd
humanhash: virginia-muppet-hydrogen-fanta
File name:PO676863.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:170'263 bytes
First seen:2020-05-25 11:58:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:/7LYoUNgaRzvzjTl28+8AxDZCNOxW+Ra5I6kSqrytex9kJdlm84oH7jaqGuFR71t:/Adf7jTlJhAnCcWH5N8gdl5H722NX
TLSH 51F3124B6DC1B18476C0B87C882DD532DED7F8F900A9A519670C65A9CCCF6EEA8A150D
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: jmlapparel.com
Sending IP: 45.11.19.32
From: Camen Lopez <jenny@jmlapparel.com>
Subject: PO#676863
Attachment: PO676863.rar (contains "PO#676863.exe")

AgentTesla SMTP exfil server:
mail.edaraproperty.net:587

AgentTesla SMTP exfil email address:
a.rafik@edaraproperty.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 01:11:15 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6997aba6d03102e0b25f8051bb7cbfd1730fa5a5b437108ff6ce17e7d66794af

(this sample)

AgentTesla

Executable exe 01762909cd4325ba993c331f78f320093830daeb5b4f9a68d579aee843ab6872

  
Dropping
MD5 96187882b44208e38659b402d8c1642e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 01762909cd4325ba993c331f78f320093830daeb5b4f9a68d579aee843ab6872

Comments