MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6f6c39b2b8850acea9fd3cb80b440f44957b81554c8f637d21fa78a12cebcf8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6f6c39b2b8850acea9fd3cb80b440f44957b81554c8f637d21fa78a12cebcf8
SHA3-384 hash: 067e2fb313526f0252e5f17eeb415e4cedc097f1b9853bb37c33fdd29c813ee05686acfaf21a6423117b26f4db621f16
SHA1 hash: a0021c000b6f8033224cd857829bea892519effb
MD5 hash: 68b2d8b16764171e4f74731f0fb77d01
humanhash: coffee-victor-video-leopard
File name:SRESTKM-series.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:513'264 bytes
First seen:2021-03-29 06:37:05 UTC
Last seen:2021-03-29 07:02:57 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:/otnVaSa8T4Sbs754PTkS/QCTs1ryxz9Qgk9aQEmLWR+v:YVamT4SwWPn/QCT+kpQL8QEAOm
TLSH 86B423C49B5B9E194716E08B15AC30DEC807A76EABCC377C43247917FC40A97D8B53AA
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.dyi.co.id
Sending IP: 103.18.28.122
From: subcon ferry <subcon@dyi.co.id>
Subject: REQUEST FOR QUOTE SRESTKM-series
Attachment: SRESTKM-series.rar (contains "SRESTKM-series.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6f6c39b2b8850acea9fd3cb80b440f44957b81554c8f637d21fa78a12cebcf8/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-29 06:15:34 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=233mhgzlrbikz2u72pfybnca6revpoavktepmn6sd6tyuewoxt4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/d6f6c39b2b8850acea9fd3cb80b440f44957b81554c8f637d21fa78a12cebcf8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d6f6c39b2b8850acea9fd3cb80b440f44957b81554c8f637d21fa78a12cebcf8

(this sample)

AgentTesla

Executable exe e662cf42ad68f990971d60274c796013df8adadcf2743debd7e3e21c4400f949

  
Dropping
MD5 ddece8e411a27c8511d7acc1f0002c0a
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e662cf42ad68f990971d60274c796013df8adadcf2743debd7e3e21c4400f949

Comments