MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6730d417bd8c501bd2916a15b8bd0b3577759848245686f47ba3a1994059bb3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6730d417bd8c501bd2916a15b8bd0b3577759848245686f47ba3a1994059bb3
SHA3-384 hash: d21da1a8cfb958f0e18f496007ad2d7f31223a62c72bd4caf03f8ace346102aac653aa98ec4c68b9e074093153df021f
SHA1 hash: 5898154b466f7a474bb72f6f74a446fe34709ef2
MD5 hash: a6f153b447d06107d5d63b0a978044e5
humanhash: sad-mockingbird-eleven-island
File name:ORDER.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:430'440 bytes
First seen:2020-06-25 13:28:48 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:G3ISK97jaj8hP427LOe1W7ayUrMumk/cYyKu31EzCJGlb/hYDxyumq:mqLP42/nWirMumk/cYyBGz6G1/a7mq
TLSH 6794231CF6F473ED2280C1DD6FCC17A696CAC92E65085204AD644BF06CF5926EF8936D
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.euromaster.es
Sending IP: 82.223.70.126
From: Yacoob <yacoob@pakplastics.co.za>
Subject: New Order
Attachment: ORDER.arj (contains "ORDER.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e6730d417bd8c501bd2916a15b8bd0b3577759848245686f47ba3a1994059bb3/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 13:38:03 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4zzq2ql33dcqdpjjc2qvxc6qwnlxowmeqjcwq32hxi5btfaftozq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj e6730d417bd8c501bd2916a15b8bd0b3577759848245686f47ba3a1994059bb3

(this sample)

AgentTesla

Executable exe ec6cfe036b88320b3208921df633e7ec0e1fbd3353e6fdc9d621d5cce1b9a27d

  
Dropping
MD5 71c803d39c9408ede6cd82a219d46a14
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ec6cfe036b88320b3208921df633e7ec0e1fbd3353e6fdc9d621d5cce1b9a27d

Comments