MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d7b29a3da91c17bd554fae8afca086a2ff9418503ca5fcb338a1877a3caaa48. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d7b29a3da91c17bd554fae8afca086a2ff9418503ca5fcb338a1877a3caaa48
SHA3-384 hash: a5deeefc318923884ac267cedbca3233b9b43a322a0f2a5bf8964108b85aafa4e14d1b7307dbee32af39369bbc7b3e55
SHA1 hash: 9b9bcb20e6be760b675f540d95d87ca2df9a6614
MD5 hash: 9177304844309313b88f58f5b1793bc1
humanhash: july-mountain-freddie-high
File name:SIC_9827906277.pdf.r09
Download: download sample
Signature AgentTesla
Create hunting rule
File size:479'655 bytes
First seen:2021-01-26 12:47:57 UTC
Last seen:2021-02-12 22:18:37 UTC
File type: r09
MIME type:application/x-rar
ssdeep 12288:Fl3ydqnxKIK8RZkulvvPP8ZwqSCqzD5uD6SGpsXdsS:7IsY8Lku9f8ZwTAJTGS
TLSH 55A423D4621B2522B2E98D18BF0C6A69AF6D21001D1FFDE479C13749AD1E71FA0E923D
Reporter cocaman
Tags:AgentTesla r09


Avatar
cocaman
Malicious email (T1566.001)
From: "waseem <waseem_kolko@creet.com>" (likely spoofed)
Received: "from ham.hamragardens.com (ham.hamragardens.com [192.254.132.202]) "
Date: "Tue, 26 Jan 2021 06:22:58 -0600"
Subject: "Proforma Invoice - REMINDER"
Attachment: "SIC_9827906277.pdf.r09"

Intelligence

File Origin
# of uploads :
2
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d7b29a3da91c17bd554fae8afca086a2ff9418503ca5fcb338a1877a3caaa48/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-26 12:48:19 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nv5sti62shaxxvku7luk7sqinix7sqmfapff7sztrimhpi6kvjea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6d7b29a3da91c17bd554fae8afca086a2ff9418503ca5fcb338a1877a3caaa48

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r09 6d7b29a3da91c17bd554fae8afca086a2ff9418503ca5fcb338a1877a3caaa48

(this sample)

AgentTesla

Executable exe 8ae24432a8380607bc692f038f1d459a9c8c38ba4150904fee9ed9fa9de37bdb

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8ae24432a8380607bc692f038f1d459a9c8c38ba4150904fee9ed9fa9de37bdb

Comments