MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c3c9402f39d714164b77e0ef32acd495fdea119cb555d6fb7977e42f1c7934b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c3c9402f39d714164b77e0ef32acd495fdea119cb555d6fb7977e42f1c7934b
SHA3-384 hash: 48f0c5fdbde13c4d339303aa01e8fc1ffb76f92744fb9eb6340a594f96ccdffcd3f0b519c0b51dc659d4259a7ad79320
SHA1 hash: 196212fcff129af65b985400d2e88e265fc84ab7
MD5 hash: 5c28d265fa38dfd798a5e3d509d7e17b
humanhash: neptune-zebra-muppet-west
File name:Request For Quote PDF.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:318'495 bytes
First seen:2020-07-13 11:27:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Hs+0l7vhlmeeLN4/LfHeO+gqxBHTvw3PYr0S/TqzBaG22/YABzgIlFnZ4U:z2rmHLNiLfx+g+B0AXWF82/YAplFZ4U
TLSH 466423A64E85F926673BA7B0C8A5CA2C8EC10D407815256F41301677C71CFEA54BDF9F
Reporter abuse_ch
Tags:ABB AgentTesla MailChannels xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: aye.elm.relay.mailchannels.net
Sending IP: 23.83.212.6
From: ABB Malaysia <IN-GBS.IMS.MY@ABB.COM>
Subject: ABB Request For Quote SC0054852
Attachment: Request For Quote PDF.xz (contains "ORDER2006825PDF.bat")

AgentTesla SMTP exfil server:
webmail.saritatravels.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.44604.22252.12670.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c3c9402f39d714164b77e0ef32acd495fdea119cb555d6fb7977e42f1c7934b/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 11:29:04 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nq6jiaxttvyuczfxpyhpgkwnjfp55iizznkv235xs57ef4ohsnfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6c3c9402f39d714164b77e0ef32acd495fdea119cb555d6fb7977e42f1c7934b

(this sample)

AgentTesla

Executable exe 6af0d9e7f7aaaa03a685b4fa6e003b55ded357d4d35874f98b8deaafbae7f2b1

  
Dropping
MD5 eb441a7f4ae42f3c61d90fe6c1f52a37
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6af0d9e7f7aaaa03a685b4fa6e003b55ded357d4d35874f98b8deaafbae7f2b1

Comments