MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ffee728d38a87a89950ad185daf3480371061289d9df107bac6633a59f32d8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ffee728d38a87a89950ad185daf3480371061289d9df107bac6633a59f32d8b
SHA3-384 hash: b51842c137bbf2178625ff55567f6ed191cd2d113a4ac05ab0a6eaa6371d9a9467b3a01dd996f3268b8393a530a39bee
SHA1 hash: ab1a050571aa460bd2106bf9ec2de42b3463740e
MD5 hash: e6c16354bf0893d8da5e534c8bd52268
humanhash: cola-edward-neptune-cold
File name:Inquiry Order Quotation.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:496'602 bytes
First seen:2020-08-19 11:20:14 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:dQuMwxTU9h7q3CGZ+BNaBxHKez/JRVDzfGDP5CltR1U:d8w07q6NaHHKYBnHaxClt7U
TLSH 59B423868DFB8C69D874B68ACE97D9CB211E52E0C689EA3C04F8EF41D1DD67EC031156
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mon.com
Sending IP: 117.121.213.229
From: Bernadeta Skowronska <objednavky@motogama.com.pl>
Subject: Inquiry Order from MOTOGAMA Poland
Attachment: Inquiry Order Quotation.rar (contains "Inquiry Order Quotation.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ffee728d38a87a89950ad185daf3480371061289d9df107bac6633a59f32d8b/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 23:05:55 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n77ookgtrkd2rgkqvumf3lzuqa3rayjitwo7cb52yzrtuwptfwfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6ffee728d38a87a89950ad185daf3480371061289d9df107bac6633a59f32d8b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6ffee728d38a87a89950ad185daf3480371061289d9df107bac6633a59f32d8b

(this sample)

AgentTesla

Executable exe 75452ea0fb7435cc2137e8a7c274a65f93a4898fc4e57ec3196c1720b4a9f9cc

  
Dropping
MD5 a1779a8a2a8a5212c462fcc19502aa63
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 75452ea0fb7435cc2137e8a7c274a65f93a4898fc4e57ec3196c1720b4a9f9cc

Comments