MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b3f09cef3e04f54e2c438fe71e1c0cb9f3f5527bbb57c3299a7b5e1f756be13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	6b3f09cef3e04f54e2c438fe71e1c0cb9f3f5527bbb57c3299a7b5e1f756be13
SHA3-384 hash:	5c8a0ffd11d083ee07d19023788c345cd9424888bfbeff4279d04412f05f618f8d6ef446e8d8eceaea755712929937e1
SHA1 hash:	c3b3774413e9c5347d9eafb9716bfffc0cb3b4cc
MD5 hash:	a712afb703e6be79cb8b016b22726dca
humanhash:	nine-lithium-montana-iowa
File name:	a712afb703e6be79cb8b016b22726dca.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'018'331 bytes
First seen:	2021-04-05 19:17:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	1536:bp9WIoj5x4ChS5hpCBxQxi5M2DVpR230gucxUr0ZPlMxs+B25qQPNoDHYDHIFcAB:lDoj5X
TLSH	99259C62F6FAB6D974A233FE487579F10903BEEA817A36DF4318111CA72418609D07BD
Reporter	abuse_ch
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

179

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

a712afb703e6be79cb8b016b22726dca.exe

Verdict:

No threats detected

Analysis date:

2021-04-05 19:58:11 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/953207e3-ad89-48dc-9a9e-ebcdb7eb2278

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/132419/

Result

Verdict:

Malware

Maliciousness:

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/666508

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6b3f09cef3e04f54e2c438fe71e1c0cb9f3f5527bbb57c3299a7b5e1f756be13/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nm7qttxt4bhvjywehd7hdyoazopt6vjhxo2xymuzu626d52wxyjq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/210405-nfmcz7tm56/

Unpacked files

SH256 hash:

6b3f09cef3e04f54e2c438fe71e1c0cb9f3f5527bbb57c3299a7b5e1f756be13

MD5 hash:

a712afb703e6be79cb8b016b22726dca

SHA1 hash:

c3b3774413e9c5347d9eafb9716bfffc0cb3b4cc

Link:

https://www.unpac.me/results/556f1781-4eb8-4864-9709-2c380901eb21/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/6b3f09cef3e04f54e2c438fe71e1c0cb9f3f5527bbb57c3299a7b5e1f756be13

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time