MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e570e257e1d6f826a8ed9ee4d46aa69e36fd6f0fddd57f432f993fdaf4fc237. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e570e257e1d6f826a8ed9ee4d46aa69e36fd6f0fddd57f432f993fdaf4fc237
SHA3-384 hash: f032f9933cc5329d1b91e11695b29fa7abf426ddf000e1c7555ed0c89eb82460aeaffbe9cc8424e9ebca93ed19a61a1a
SHA1 hash: 608c72b3c06c2e550d41c36df373457e183f0c0a
MD5 hash: 8eab84ad3fb44465f006c9b78b3e847c
humanhash: nineteen-bulldog-cold-pizza
File name:PAYMENT SLIP.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'029'782 bytes
First seen:2020-05-26 11:08:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:ceFtgAgw+VT6ClfnLvtl3kHrtd3QLLsUMpD7k0qASgTg:ceFt+DVT5a/ghMpD7k1h
TLSH 60253315F0E224EC903F4F2E3EC9AC1E9917125578CECA89232DF9D55E804D6FA906E2
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.andalanfluids.com
Sending IP: 180.235.150.93
From: Mohammad Hasan <mohammad.hasan@bearingcitysc.com>
Subject: Payment Slip - Payment remitted 28/04/2020
Attachment: PAYMENT SLIP.zip (contains "PAYMENT SLIP.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22148.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 11:36:59 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6e570e257e1d6f826a8ed9ee4d46aa69e36fd6f0fddd57f432f993fdaf4fc237

(this sample)

AgentTesla

Executable exe 9350e2b52b57a3f17169e6b46a888559dea995d2de8c61a4cdbcbb340d530dff

  
Dropping
MD5 5d401208a61eb45a0a42ace4528329a7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9350e2b52b57a3f17169e6b46a888559dea995d2de8c61a4cdbcbb340d530dff

Comments