MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6fdab320ccb62c703f9030c92f68d8100097467a0ac40a1e173a2c7e871932b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6fdab320ccb62c703f9030c92f68d8100097467a0ac40a1e173a2c7e871932b
SHA3-384 hash: fe9598ad6cd5ce8d8dc7dca4cbb4593cb047b33fd8bcfe4d3d7aa144c7c47db7c076a09fd2247b377426a13d0e9596c2
SHA1 hash: 3b41075ad18dc670490437a7cd73837df96557ba
MD5 hash: 0a492ba11ac992ddf7c8561f77322a1e
humanhash: spaghetti-nitrogen-winter-summer
File name:POAZ566-L.lzh
Download: download sample
Signature AgentTesla
Create hunting rule
File size:340'702 bytes
First seen:2021-04-04 06:37:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:07+t6CXRXG+Q5SP1YiZQGmJqDEYIhzjjvagzDw7x3u/inv8+ORx0sJpi87:G+tFXRXGkm2sJeEthzjjvm7VuaO8sTiI
TLSH 7E7423E91C4CA1EEF94C2C52AFFBAB53E277588A1DF4AF58821037B05DA052C65E3C11
Reporter abuse_ch
Tags:lzh


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.essae.com
Sending IP: 14.141.34.42
From: quote the prices <mollah.sari@yahoo.com>
Reply-To: mollah.sari@yahoo.com
Subject: April combined order
Attachment: POAZ566-L.lzh (contains "POAZ566-WWL-005A Lesser Pavey Ltd HSL Worldwide.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
296
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6fdab320ccb62c703f9030c92f68d8100097467a0ac40a1e173a2c7e871932b/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2021-04-03 13:32:01 UTC
AV detection:
3 of 36 (8.33%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2362wmqmznrmoa7zamgjf5unqeaas5dhucwebipboormp2drsmvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d6fdab320ccb62c703f9030c92f68d8100097467a0ac40a1e173a2c7e871932b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d6fdab320ccb62c703f9030c92f68d8100097467a0ac40a1e173a2c7e871932b

(this sample)

AgentTesla

Executable exe a47e971bd76da39e18307424c6bfacd9aed830139cb2822f942d97223467e601

  
Dropping
MD5 639630f820d080aa0598dadc0c91605e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a47e971bd76da39e18307424c6bfacd9aed830139cb2822f942d97223467e601

Comments