MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6c2749d82560c5ca8a76342adbc6e3209d7a940e9c1ac29e62a1f224001aaaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6c2749d82560c5ca8a76342adbc6e3209d7a940e9c1ac29e62a1f224001aaaf
SHA3-384 hash: 8dcaf04f25b6574371e27c34cc66d0a5da1697432f5c158c8615d463a4837a34a67863c2bc0dbe8e79e78b0b6975472a
SHA1 hash: 3848ce89546b2d056ae9e4eba7eff566f1538b67
MD5 hash: f20c3fcc0335458766a326b816d6e392
humanhash: bluebird-india-nevada-quebec
File name:FA17060220.r11
Download: download sample
Signature AgentTesla
Create hunting rule
File size:770'014 bytes
First seen:2020-07-20 11:38:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:SPwPIluzfgFd8/kZmnBGlQGcw9EcPB2vcAbcoPrdBN3rQudzDaoWfnCF1AZH:SRFK8ZmBEKw9EJkABBD3O1fCFO1
TLSH B5F4339F5A8FB215721D76065071CB673BF8B28126035461CFA3ED3098A2E64B173F79
Reporter abuse_ch
Tags:AgentTesla r11


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.example.com
Sending IP: 103.109.37.33
From: Ufficio logistica/shipping dept. <admin@moenepa.ga>
Subject: Confirmation of Order 3197154
Attachment: FA17060220.r11 (contains "FA17060220.exe")

AgentTesla SMTP exfil server:
fadicogroup.cf:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b6c2749d82560c5ca8a76342adbc6e3209d7a940e9c1ac29e62a1f224001aaaf/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 11:40:07 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w3bhjhmckygfzkfhmnbk3pdogie5pkka5ha2ykpgfipseqabvkxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b6c2749d82560c5ca8a76342adbc6e3209d7a940e9c1ac29e62a1f224001aaaf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar b6c2749d82560c5ca8a76342adbc6e3209d7a940e9c1ac29e62a1f224001aaaf

(this sample)

AgentTesla

Executable exe f75d8637bf5e657cbd18bbeebb6dfee8aac3734021efc1334112c3dc78591d50

  
Dropping
MD5 ae70f097bba34d2ed3d92f75315c8394
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f75d8637bf5e657cbd18bbeebb6dfee8aac3734021efc1334112c3dc78591d50

Comments