MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da6fec927da0686ae224f67c94e1180b7aceec10ce27150150642a8a7bcf4c84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da6fec927da0686ae224f67c94e1180b7aceec10ce27150150642a8a7bcf4c84
SHA3-384 hash: e5c4dddade10184d69c76a9ec47c089887b34188030ed06b5328e1b62b8bc4339c4c1429a4b526fbcd9216c93e40ab4d
SHA1 hash: 4c708ceb3d8971546ffc40043d2ef8a6eae83c75
MD5 hash: 6806c3059b356ff6bcf98d7ff73da5a7
humanhash: berlin-colorado-quebec-uranus
File name:PO SHEET pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:646'694 bytes
First seen:2020-10-26 14:49:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:zcnTXflIRyoYOBCXXjOVMcxmxEhUDaFBIzf/TMiPhlMm7Loa3Aqvog:zcnTvfjMzM0mf4iPhKsn3Avg
TLSH D7D4339B936C6BF250D79AE07025950C0FE8946EAF8E2164BB845450BBD370B6DF384E
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ekinci-insaat.com
Sending IP: 103.151.124.83
From: Mayor<info@ekinci-insaat.com>
Subject: FIND THE ATTACHED NEW OERDER DETAILED FOR PI REQUEST
Attachment: PO SHEET pdf.rar (contains "PO SHEET pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27342.RarHeur.v5.HideExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da6fec927da0686ae224f67c94e1180b7aceec10ce27150150642a8a7bcf4c84/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 08:36:19 UTC
AV detection:
8 of 29 (27.59%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3jx6zet5ubugvyre6z6jjyiybn5m53aqzytrkakqmqviu66pjsca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar da6fec927da0686ae224f67c94e1180b7aceec10ce27150150642a8a7bcf4c84

(this sample)

AgentTesla

Executable exe cb90611100b4768af8360f3866d0fd280e232c47ec1093105ad5d1f41731bf94

  
Dropping
MD5 1573caa4f1506ffcd4957ede886cbcb2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cb90611100b4768af8360f3866d0fd280e232c47ec1093105ad5d1f41731bf94

Comments