MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6bd91acba2c0bd4639910d3f1674fbdb89295de8c458e15b99ea841be7619716. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6bd91acba2c0bd4639910d3f1674fbdb89295de8c458e15b99ea841be7619716
SHA3-384 hash: 9b6a838126c174ae4caec738215f0ce95f56e85e6fddc232cf68e12e8eba428e56d94f8b8499451920bf9e7a5fd1864a
SHA1 hash: 137a958fc592e5c6c986940e3a443aec0b1b7fa9
MD5 hash: f4691f46a0749d227dca17fb25d2311f
humanhash: wyoming-table-diet-venus
File name:Offer Sheet-2310043 Qingdao Meigao PO_Offer EST20055.pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:404'942 bytes
First seen:2020-06-26 06:27:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:To7TbElYOToaSDB5md0Fo/a1ggtxmnHUV583/F:T+85R9dOo/sguxmnHUbw
TLSH 468423E35043DB83E37B92E282370EAB1BB578F2647C411844A46F15974063F47AAFA5
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.radmadengines.com
Sending IP: 162.241.204.155
From: Meigao Purchase<Purchase@silica-gel.com.cn>
Subject: Qingdao Meigao Pending Project PO+Offer (RFQ 34550 March Qoute)
Attachment: Offer Sheet-2310043 Qingdao Meigao PO_Offer EST20055.pdf.rar (contains "PO_0ffer#EST20055.pdf.exe")

AgentTesla SMTP exfil server:
smtp.cdldxy-cn.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6bd91acba2c0bd4639910d3f1674fbdb89295de8c458e15b99ea841be7619716/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 06:29:04 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=npmrvs5cyc6umomrbu7rm5h33oessxpiyrmocw4z5kcbxz3bs4la._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6bd91acba2c0bd4639910d3f1674fbdb89295de8c458e15b99ea841be7619716

(this sample)

AgentTesla

Executable exe 879f7d3f4ff78cd66006103c3c9d438aaae14c7b069f4235898157bb6907212a

  
Dropping
MD5 3c44cbc7ae7c2b3a857cab39c8c81e81
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 879f7d3f4ff78cd66006103c3c9d438aaae14c7b069f4235898157bb6907212a

Comments