MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da6711a6102657b7af81f947425cac9890d18bd67e9e09dd5cc6617d8f3c65fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da6711a6102657b7af81f947425cac9890d18bd67e9e09dd5cc6617d8f3c65fb
SHA3-384 hash: 769f37eadff006ac1a760bb0ddc485dfe8ec1c9e123c1a2be28059a82519af2cf14e9416bc5cc515cfbf1be4d3866487
SHA1 hash: 791873972e7f255e1f64f12a19f5a7068a8f2714
MD5 hash: 202c68fca9eaea0699ba2147ac49a216
humanhash: tennis-robert-cola-papa
File name:inv BM-032720W.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:663'659 bytes
First seen:2020-10-13 05:49:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:XHIeoS/VB93OiBF/0y80aZ2xvsQ8pc637nKlTY6vXYRZzM:Xrf/VB9+iBF/U0aZA0Q+cFTY6vYY
TLSH 7BE4237B6AAB3AE8DB0E39211C8758A87CDC1395FC4779EDD39B148B9C20EBC5061095
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: partech.com.tw
Sending IP: 45.137.22.72
From: 昶誠 Elsa Tsai <Elsa@partech.com.tw>
Subject: Re: Invoice for the next delivery to BMW Berlin (Partech)(Inv# BM-032720W)
Attachment: inv BM-032720W.zip (contains "inv# BM-032720W.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42621.31230.9316.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da6711a6102657b7af81f947425cac9890d18bd67e9e09dd5cc6617d8f3c65fb/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-13 04:14:08 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3jtrdjqqezl3pl4b7fduexfmtcindc6wp2patxk4yzqx3dz4mx5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/da6711a6102657b7af81f947425cac9890d18bd67e9e09dd5cc6617d8f3c65fb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip da6711a6102657b7af81f947425cac9890d18bd67e9e09dd5cc6617d8f3c65fb

(this sample)

AgentTesla

Executable exe bced2082dc766d01bcbb3b1ad8da3b6e482caaef683444a76fadb3bd543d26ec

  
Dropping
MD5 6cdfd08cb1d353a93fbaf822060f9d7d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bced2082dc766d01bcbb3b1ad8da3b6e482caaef683444a76fadb3bd543d26ec

Comments