MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e54bdfa6101ec27dcd32bfc196fc733b1fc4531223a28f90662115bc59cc4dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e54bdfa6101ec27dcd32bfc196fc733b1fc4531223a28f90662115bc59cc4dc
SHA3-384 hash: 53b6a8a168fbc7c2fb2f2931807732a6637de93bb0959b18ca237cf192d8153283f9fdec5db59d4cac3c06ddc1ea7d24
SHA1 hash: 2c626c593640df71c9cf56964cd656fcddd65669
MD5 hash: 27db3af00f52e5319c7bf65c6d1abd56
humanhash: summer-harry-virginia-kansas
File name:Quotation0988.SDcan.pdf...zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:260'778 bytes
First seen:2020-10-15 11:30:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:2Ri8Ga2LFHoR/y6Jt6vUWyGqYcRAwVjPlpj4Dg57TlooRWot55fM7D9tc2JDYvB:KrGa2OR/yQt6MWLBcRrzj9Qoj5hSDFh+
TLSH 1C442342FC3DE7FB470896BA9D106753969E46921514133BDA73CE0E4C49F060BB9A3D
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.shvietnam-vn.com
Sending IP: 45.95.169.113
From: info@shvietnam-vn.com
Subject: Re: Quotation Inquiry
Attachment: Quotation0988.SDcan.pdf...zip (contains "cryptedd rock2.0.exe")

AgentTesla SMTP exfil server:
mail.bosut.mk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e54bdfa6101ec27dcd32bfc196fc733b1fc4531223a28f90662115bc59cc4dc/
Threat name:
Win32.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 01:20:18 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nzkl36tbahwcpxgtfp6bs36hgoy7yrjrei5cr6igmiivxrm4ytoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6e54bdfa6101ec27dcd32bfc196fc733b1fc4531223a28f90662115bc59cc4dc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6e54bdfa6101ec27dcd32bfc196fc733b1fc4531223a28f90662115bc59cc4dc

(this sample)

AgentTesla

Executable exe 47602d03fd9625c7212ea4b5dbb919f587f4e5d5c3eedf58304bf5a851beac9a

  
Dropping
MD5 7fc0f82e015beb54208ade3ec31edae0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 47602d03fd9625c7212ea4b5dbb919f587f4e5d5c3eedf58304bf5a851beac9a

Comments