MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d82f3d418dc2e3afbd9ce862bc73827066ac653b676f53284e2556651f625fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d82f3d418dc2e3afbd9ce862bc73827066ac653b676f53284e2556651f625fc
SHA3-384 hash: dd3674a9c133f7a6abe466cd16ccbc1ad70a962118916511cb862cb3fca635aa3a4221fc6e426ad708f776c0b4ceb007
SHA1 hash: b630bc2ecc1b8ca7b17d9657c9fef6716c58b5ae
MD5 hash: 36bde0ba2166440948510f05ff408504
humanhash: blue-network-zebra-comet
File name:Purchase order001pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:808'176 bytes
First seen:2021-01-04 13:14:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:2MVcCzgQP0kLhuKI7thMRm5mlXJOb8pyi9GnsypBYvLneT3i/p4m1lncHN:5VcmRLNtWjomo1JM8snF0L7uYlnON
TLSH 4505231420218034A18DFB1625A3E19B64F062EC2C767DF7F64ACE95DCE6CCBBB67442
Reporter abuse_ch
Tags:AgentTesla rar Yahoo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic312-25.consmr.mail.ir2.yahoo.com
Sending IP: 77.238.178.96
From: morris alexander <morris.alexander67@yahoo.com>
Subject: RE: Invoice Needed
Attachment: Purchase order001pdf.rar (contains "Purchase order001#pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
229
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d82f3d418dc2e3afbd9ce862bc73827066ac653b676f53284e2556651f625fc/
Threat name:
ByteCode-MSIL.Packed.Bulz
Create hunting rule
Status:
Malicious
First seen:
2021-01-04 09:48:24 UTC
AV detection:
10 of 29 (34.48%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nwbphvay3qxdv66zz2dcxrzye4dgvrstwz3pkmue4jkwmupwex6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6d82f3d418dc2e3afbd9ce862bc73827066ac653b676f53284e2556651f625fc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6d82f3d418dc2e3afbd9ce862bc73827066ac653b676f53284e2556651f625fc

(this sample)

AgentTesla

Executable exe 12f2ee1cc6d06299b1a044cae83201d6550122a5e4ea1b3211415aba57059f14

  
Dropping
MD5 0ded2c15920dae29fd1d96311563f76f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 12f2ee1cc6d06299b1a044cae83201d6550122a5e4ea1b3211415aba57059f14

Comments