MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6acc1fbf14b0cdb4460c1d8f8f913f9f867525126afac4f7428ef06a34698ed0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6acc1fbf14b0cdb4460c1d8f8f913f9f867525126afac4f7428ef06a34698ed0
SHA3-384 hash: cd32b069c35af90656d783465743d2888ca5944d039a2bd20f4474e84e3bd797351a1f4ea81cff66da8707dc1e3649c6
SHA1 hash: 700cc17da024d82ebeb2aa71f932e183d63e7007
MD5 hash: 22cf070953e8df38a8cb98b9ac7f448f
humanhash: tennessee-iowa-island-golf
File name:Payment Slip.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:883'855 bytes
First seen:2020-12-22 06:46:23 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:OE5ZOn3b0/i89KgX1sRrAjCw5Dq3pihtwRxKudMbApYUPkfFb/5axInU4JZfW37j:OE/cAd2SGI0Z4/5gIU4XW33n
TLSH 8E1533FF6586BA6C9DB27338771968CD579322E83869CBF6840F016C204F7DE9965C20
Reporter cocaman
Tags:AgentTesla z


Avatar
cocaman
Malicious email (T1566.001)
From: "Operation manager<Gujrat.Branch@alkuhaimi.com>" (likely spoofed)
Received: "from alkuhaimi.com (unknown [185.222.57.185]) "
Date: "21 Dec 2020 20:50:03 -0800"
Subject: "PAYMENT INSTRUCTION"
Attachment: "Payment Slip.pdf.z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
266
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6acc1fbf14b0cdb4460c1d8f8f913f9f867525126afac4f7428ef06a34698ed0/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 06:32:25 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nlgb7pyuwdg3irqmdwhy7ej7t6dhkjisnl5mj52cr3ygundjr3ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6acc1fbf14b0cdb4460c1d8f8f913f9f867525126afac4f7428ef06a34698ed0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 6acc1fbf14b0cdb4460c1d8f8f913f9f867525126afac4f7428ef06a34698ed0

(this sample)

AgentTesla

Executable exe 4c42b2d7062de59d0e879b4ee2760059602a8f1283d80a821db2ea2940c186a9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4c42b2d7062de59d0e879b4ee2760059602a8f1283d80a821db2ea2940c186a9
  
Dropping
AgentTesla

Comments