MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6adb015900b5f72a59a81b9c61259509ae9f700b98a74f86ecaba77fc64254f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6adb015900b5f72a59a81b9c61259509ae9f700b98a74f86ecaba77fc64254f5
SHA3-384 hash: c95160d97d5c5e295c40f8ae498e62b029d4d27ffb70acb4491b90ab14fb5bad09f6a903c712b904829fe7977e46cb9f
SHA1 hash: ff18a0b1ad777c482071cc87e5dcc63a913ca67a
MD5 hash: e86383c6080fdc7e7e242c7873d49ee1
humanhash: maine-pennsylvania-romeo-robert
File name:PO-02528.GZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:384'863 bytes
First seen:2020-06-17 06:06:08 UTC
Last seen:2020-06-17 07:49:03 UTC
File type: gz
MIME type:application/x-rar
ssdeep 6144:LZd8yyiq+D8HaXJvB6vtn+pOGAZE3/+0d6X3niKm54MPheaLGTFfl41ao+KqdIha:Fdlyiqr6f6vtn+pOJiP6niYEheaGy1jw
TLSH DC8423619E7B5DBA7C2FECCDAE610E22780575DE0C2B3D1CC638510BE1A14B94B7D6A0
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ONE-LINE.COM
Sending IP: 185.222.58.155
From: Import Customer Service <TH.BKK.IDO.INQ@ONE-LINE.COM>
Subject: CPL-PO-02528
Attachment: PO-02528.GZ (contains "PO-02528.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 06:08:04 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nlnqcwiawx3suwnidoogcjmvbgxj64altctu7bxmvotx7rsckt2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 6adb015900b5f72a59a81b9c61259509ae9f700b98a74f86ecaba77fc64254f5

(this sample)

AgentTesla

Executable exe 2c8de6b2a0ff5ef7e83675c1aa329ace54aabca30f3140cce47bea8531a795b3

  
Dropping
MD5 1714d693557761d8864d150a94bdec00
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2c8de6b2a0ff5ef7e83675c1aa329ace54aabca30f3140cce47bea8531a795b3

Comments