MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6eeb0d386fc110cb6ae44e66db6886c1645e2268267a1f28533754d8e7ce3d9d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6eeb0d386fc110cb6ae44e66db6886c1645e2268267a1f28533754d8e7ce3d9d
SHA3-384 hash: f2b8f34d7e3195fdb9a38f8b55d59f5a69946057135da5679a096ff9add5f4f4a3bd021d1cfe2e9f18a7bce94e6ca10b
SHA1 hash: 537e9791a422820fff4a8a8c0c6a74c8af985e66
MD5 hash: 46fbe1a2448829cd84d250772623476c
humanhash: sierra-gee-bulldog-idaho
File name:RFQ Bag 6.24.20.pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:518'965 bytes
First seen:2020-07-21 18:46:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:1Wwu4cddwIgbSUM9HCPXwI3jiHZ0NnXUik3XdAKF0Pq8HPzT:1WwobU6i4FZykiWXN0PJHP3
TLSH C9B423BBED406340113EA1E7A959862C9F5901D5F5F7CCC8D0246DDF86C0D4ABA2BACB
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sltidc.lk
Sending IP: 124.43.128.148
From: Alvin TAN <info@deluxeautouae.com>
Subject: RFQ for USA Handle Bag.
Attachment: RFQ Bag 6.24.20.pdf.rar (contains "RFQ Bag 6.24.20.pdf.exe")

AgentTesla SMTP exfil server:
bh-58.webhostbox.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6eeb0d386fc110cb6ae44e66db6886c1645e2268267a1f28533754d8e7ce3d9d/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 18:48:08 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n3vq2odpyeimw2xejztnw2egyfsf4itiez5b6kctg5knrz6ohwoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6eeb0d386fc110cb6ae44e66db6886c1645e2268267a1f28533754d8e7ce3d9d

(this sample)

AgentTesla

Executable exe 63df2602ff2676e438e25c4544562736eb3c4da856280600d7790edcd0478914

  
Dropping
MD5 aa328325ffd6eb33df17a33b37c545b8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 63df2602ff2676e438e25c4544562736eb3c4da856280600d7790edcd0478914

Comments