MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cfebc3f6bee0d87a9b16f69178e33218caec203981717caea671d647c4c7ccb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6cfebc3f6bee0d87a9b16f69178e33218caec203981717caea671d647c4c7ccb
SHA3-384 hash: dcdf9adfc72371602ef31a11814999c388bdf4f3683450c3bbf3783f68d3983604415bd55841fbb4ede3870e4d88e6e5
SHA1 hash: 4c20b805f81b303825cbb57926d15a2036121548
MD5 hash: f948cc3cc2fe409149505135f37f6d50
humanhash: california-muppet-pluto-kitten
File name:Scan003.pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:619'027 bytes
First seen:2021-01-06 08:03:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:TA2+JVFoXD3BTGRCRZRnBRLNC+Bss3uHA5KAzQ94pWLgLAP:TA2+dOFtRnLNC+ss3ugUd94O
TLSH 64D423772F640B61B7B88ED69EE87D771210CF90F5918A499DE9E88C4C31E2AC44372D
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ortobennett.com
Sending IP: 45.15.143.210
From: Account Manger <ortobennett@ortobennett.com>
Subject: Payment
Attachment: Scan003.pdf.rar (contains "Scan003.pdf.exe")

AgentTesla SMTP exfil server:
smtp.vivaldi.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6cfebc3f6bee0d87a9b16f69178e33218caec203981717caea671d647c4c7ccb/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-06 05:31:02 UTC
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nt7lyp3l5ygypknrn5urpdrteggk5qqdtalrpsxkm4owi7cmptfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6cfebc3f6bee0d87a9b16f69178e33218caec203981717caea671d647c4c7ccb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6cfebc3f6bee0d87a9b16f69178e33218caec203981717caea671d647c4c7ccb

(this sample)

AgentTesla

Executable exe 5cf8e944ea54195e221343dec2bb3728c5faecc2b55be781b597503a7ae2fd39

  
Dropping
MD5 2a479d08a46cfa1ff0e0a379ee4fc79d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5cf8e944ea54195e221343dec2bb3728c5faecc2b55be781b597503a7ae2fd39

Comments