MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ce07a9822ab0f92ea31954eead2c821a3a5d569c7468e01947ec504a2e5f77e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ce07a9822ab0f92ea31954eead2c821a3a5d569c7468e01947ec504a2e5f77e
SHA3-384 hash: 93d5b9da06d0aedb21ca8ad7064f3a6c45f8fcdf33bcfd3ebc8b6fc87cd1320012cbf3eedd564d7be6649d797f4fef3e
SHA1 hash: 2dd94d0231e05f64df14e1ed97724c5aabfe9952
MD5 hash: d9e16737b268e541c68cd8fc20682766
humanhash: lion-speaker-purple-uncle
File name:New Order.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:398'895 bytes
First seen:2020-05-25 12:59:14 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:jE+o8OSuvCCFovacJMeai1qkNR9DDNZYnMBnmlueV0FpuBq3xVdCrv13NLF:jBoLvnovaQsSxR9DDN5mY46Z3xVmd3NZ
TLSH 208423BBF4754392A7B910AB2F3F9F91BB9265081C3E0647CD41098B3F1219785A3D9E
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: serve0.fp189.pw
Sending IP: 173.82.243.104
From: Jose Landeros <info@fp189.pw>
Subject: New order
Attachment: New Order.arj (contains "New Order.exe")

AgentTesla SMTP exfil server:
mail.navarronavarrosl.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 13:36:52 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 6ce07a9822ab0f92ea31954eead2c821a3a5d569c7468e01947ec504a2e5f77e

(this sample)

AgentTesla

Executable exe 6cacb53730640ce58bbb9c5bc6c6d39b5ea9c7a0d21eec9ce131f82c0e159361

  
Dropping
MD5 2339ad41241eb758d7070d1dd58fd461
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6cacb53730640ce58bbb9c5bc6c6d39b5ea9c7a0d21eec9ce131f82c0e159361

Comments