MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f5b77c86413206233142b2ba3578f6c63b3c5ae40d41d08d7fca71aba35ea34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f5b77c86413206233142b2ba3578f6c63b3c5ae40d41d08d7fca71aba35ea34
SHA3-384 hash: 7d091dd48aa2c6880bf49ac2b3868945b0b3d443bf462c730b01ce0ade419345522935797cb8ab42c7808acfb9794657
SHA1 hash: 16e2cad31d0904044cd4015733bc2eeb4e2862d6
MD5 hash: 1be02360fc537969c6f74c23b4409a5e
humanhash: sad-december-edward-sink
File name:PO-8372929.r01
Download: download sample
Signature AgentTesla
Create hunting rule
File size:729'537 bytes
First seen:2020-08-31 06:01:11 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 12288:rj2yLut5anI0oRPmKPGhRly0p4IJBA8+MYhrK+mKTK2xQFWE:Wyw0oReKMmIJBAEL+lnKFx
TLSH 8DF4233741DB0E404EA0A1BEE552DD30D63B6080DE5AC7D5226FE8B91756A80E7FBE21
Reporter abuse_ch
Tags:AgentTesla r01


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: euk-98384.eukservers.com
Sending IP: 213.175.208.121
From: mp@inspiretz.co.tz
Subject: Provide Quotation For The Listed Items
Attachment: PO-8372929.r01 (contains "PO-8372929.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f5b77c86413206233142b2ba3578f6c63b3c5ae40d41d08d7fca71aba35ea34/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-08-30 20:30:01 UTC
AV detection:
13 of 25 (52.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n5nxpsdecmqgemyufmv2gv4pnrr3hrnoidkb2cgx7strvorv5i2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6f5b77c86413206233142b2ba3578f6c63b3c5ae40d41d08d7fca71aba35ea34

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r01 6f5b77c86413206233142b2ba3578f6c63b3c5ae40d41d08d7fca71aba35ea34

(this sample)

AgentTesla

Executable exe 4aba472bffc408315c06d8d015ac5241175d6ccfea8c3c04065ba64eccd94cfb

  
Dropping
MD5 25d6413e1ea562551c244fa9ab2ac6a3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4aba472bffc408315c06d8d015ac5241175d6ccfea8c3c04065ba64eccd94cfb

Comments