MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e6e357132958be355d50dd92de978df50531c18670a4e20de7ac0193f485001. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e6e357132958be355d50dd92de978df50531c18670a4e20de7ac0193f485001
SHA3-384 hash: f8fc47118646aff92cc1dba83019f2831c70ea9b790c82312e262f99d88f1bde403f53abcbee67a7c054a2a6f1924036
SHA1 hash: 484003b9ed85c89fec36b5ba150b73e316b19afa
MD5 hash: 10d07ab7a2cfde7b534979f80d018235
humanhash: minnesota-earth-alpha-hawaii
File name:Purchase Order Ref MYRAM-BDM-10752-POR-001.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:514'013 bytes
First seen:2020-08-19 13:27:27 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:gyCvU84RjQTwpxzadZwRqu1gX3zYs8MNmbSA8GbMpk6/rU:gN8nBpxzad39X18smGA8GbMpkaQ
TLSH 9AB42386CD0EDF13D1346D86D1F464BA74B8CA09CC5B75A347F4866ED680C21B8EE3A6
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: te.techniserv.live
Sending IP: 45.95.171.132
From: Aiman Aziz <aiman.aziz@myram.com.my>
Reply-To: Aiman Aziz < info@techniserv.live>
Subject: Purchase Order Ref : MYRAM-BDM-10752-POR-001
Attachment: Purchase Order Ref MYRAM-BDM-10752-POR-001.zip (contains "Purchase Order Ref MYRAM-BDM-10752-POR-001.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e6e357132958be355d50dd92de978df50531c18670a4e20de7ac0193f485001/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 13:29:04 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nzxdk4jsswf6gvovbxms32ly35ifghaym4fe4ig6plabsp2ikaaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NanoCore
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6e6e357132958be355d50dd92de978df50531c18670a4e20de7ac0193f485001

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6e6e357132958be355d50dd92de978df50531c18670a4e20de7ac0193f485001

(this sample)

AgentTesla

Executable exe e1ee883706a9a38147182dfb3769ef61d4cc3237d962e246849766b79e14754a

  
Dropping
MD5 3185163ff4f7fafe0f5cbee1a11526aa
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e1ee883706a9a38147182dfb3769ef61d4cc3237d962e246849766b79e14754a

Comments