MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ee17431845a95a92b1dcd14897a3d56373123ce63edf66b050c52f9684baa1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ee17431845a95a92b1dcd14897a3d56373123ce63edf66b050c52f9684baa1d
SHA3-384 hash: 47bb16e9be0ce1fd0159c8b90bedebc34ac2a31db04de6956edd887b0403962171ec2dfa6bb51bbd8978b0185db7c9b4
SHA1 hash: 37e8b96ae8db659f984c4bc01f9933ea46c3e8d1
MD5 hash: 72c98f203e54185b260589d3fff9213c
humanhash: cola-lemon-wisconsin-early
File name:Inquiry_PDF.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:359'852 bytes
First seen:2020-05-11 09:25:59 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:xdtpyojQo7zj28cTi5hGrVuDcpNSuol5EKjoem945iW3U4YcaYvYRNl:9pyojQ02fs8JuDaclQemGiWE1eYRX
TLSH FF7423729381DE079FA522DE894D5E45A97C3472F8787B21628FC43C3F2BD0A6094D72
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: [209.58.149.66]
Sending IP: 209.58.149.66
From: Jijo Joseph <sumant.k@indiaelec.com.sg>
Subject: April Quotation Request (RFQ)
Attachment: Inquiry_PDF.cab (contains "Inquiry_PDF.exe")

AgentTesla SMTP exfil server:
smtpout.asia.secureserver.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VUP.28422.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Reline
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 09:36:30 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n3qximmelkk2sky5zukis6r5ky3tci6ompw7m2yfbrjps2clvioq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 6ee17431845a95a92b1dcd14897a3d56373123ce63edf66b050c52f9684baa1d

(this sample)

AgentTesla

Executable exe 80b0c19bc7b0f30f3f6ebcef118f54efca43e46acd327dde7a4ca97a257b4c7b

  
Dropping
MD5 02b7bb84de7ba5e6b15dea6d5f9560f0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 80b0c19bc7b0f30f3f6ebcef118f54efca43e46acd327dde7a4ca97a257b4c7b

Comments