MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef6d9c469ddf8d0644ef0594fb5c3d2a2b2031fa2dd0f9413a04ec45a926d24e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef6d9c469ddf8d0644ef0594fb5c3d2a2b2031fa2dd0f9413a04ec45a926d24e
SHA3-384 hash: a85306d166941b7a29b8c1d2a4fc3bae6ee997acc0346adc445cc5d60e87fe9937a10754ec7c3ea5200d7870f817bc8f
SHA1 hash: 63f8f94b6a352acd41cc8d996347a7c0d32dbf54
MD5 hash: 18bce16549eab040ae1aedc22fdee3b4
humanhash: monkey-mike-maryland-mars
File name:GAC-PO of wire rope.xlsx.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:525'245 bytes
First seen:2020-05-21 06:44:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:9vFtL8mmBmNix9SmOzlJgUw/OXSDnVMz0Wg:9vFpd/09SmgHXSDnt
TLSH 52B4231B07E9585518F8445D7BBF0E6B197CAB6B0CD2F8331C74AF83A1E560E2E17A60
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27214.RarHeur.nocdb.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspected-exe-in-RAR.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 07:36:05 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=55wzyru536gqmrhpawkpwxb5fivsamp2fxipsqj2atwelkjg2jha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ef6d9c469ddf8d0644ef0594fb5c3d2a2b2031fa2dd0f9413a04ec45a926d24e

(this sample)

AgentTesla

Executable exe 3ce06fdf5477c3138f03977f72703a45d01d18764116f95fd41c8a8c9adfbad2

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3ce06fdf5477c3138f03977f72703a45d01d18764116f95fd41c8a8c9adfbad2
  
Dropping
MD5 47be6ef88e2253307b96d34aedf63ac3

Comments