MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d8e5ab510fb1fd7529709fea143f82307c94dfe4ed693cc04c50aca1196a543. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d8e5ab510fb1fd7529709fea143f82307c94dfe4ed693cc04c50aca1196a543
SHA3-384 hash: 57354b43d7c91f51e4454865ae80c7c7e80d4e22c7f8f7cca11119379e4b85ba42eba0662e8337cda096dd6b0a99ed79
SHA1 hash: 7b646fdf24c89ea07a01d810891f7dd28dec11e6
MD5 hash: 766d2b885abd5f39db8b81ab131a235d
humanhash: dakota-asparagus-robert-hydrogen
File name:QUOTATION.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:667'744 bytes
First seen:2021-03-31 06:00:22 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:fsnBhmlEhIKR0pXq1YNTI8biFfA20X4EqsmjZFffy0V8xLy9rdNM1:fQhAEhI9a2NsyXWaKy0/Q
TLSH 76E4239FDAC389249B19D4EB8EB3D0158BFA6F193D5984E82C42B850D137DBCB410376
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: "mitchell@demuntzoeker.be" (likely spoofed)
Received: "from postfix-inbound-2.inbound.mailchannels.net (inbound-egress-5.mailchannels.net [199.10.31.237]) "
Date: "30 Mar 2021 21:34:39 -0700"
Subject: "Re: (JL) 3/30/2021 Order Inquiry."
Attachment: "QUOTATION.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d8e5ab510fb1fd7529709fea143f82307c94dfe4ed693cc04c50aca1196a543/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 04:03:44 UTC
File Type:
Binary (Archive)
Extracted files:
39
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nwhfvniq7mp5ouuxbh7kcq7yemd4stp6j3ljhtaeyufmuemwuvbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/6d8e5ab510fb1fd7529709fea143f82307c94dfe4ed693cc04c50aca1196a543

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 6d8e5ab510fb1fd7529709fea143f82307c94dfe4ed693cc04c50aca1196a543

(this sample)

AgentTesla

Executable exe 7707ba85b887aaf88da9b91fce5576f15b92c03bcfe253424313e4e1c93175e9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7707ba85b887aaf88da9b91fce5576f15b92c03bcfe253424313e4e1c93175e9
  
Dropping
AgentTesla

Comments