MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6c50e09e157a0247ecaabb79effa55c6855fb784b30c4c38502e07b24859842. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6c50e09e157a0247ecaabb79effa55c6855fb784b30c4c38502e07b24859842
SHA3-384 hash: e2fbb4ce51682b31ef21bbede3086e315eb9eb0bce3a9364759c9139d18f28df6d8f42e70f322cee06bee1c532ed3916
SHA1 hash: e4034a0968c5c56f64b4f83ad9e5cfb7f1d55b8d
MD5 hash: aa4b323d1ef622d4817129094bf255d5
humanhash: apart-december-seven-island
File name:SOA OCTOBER 2020.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:583'726 bytes
First seen:2020-11-16 06:55:45 UTC
Last seen:2020-11-16 08:10:04 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:7R8s2ctOZkrNMX8LHwsLG/O4lfpMKZhq1r0BXK9V3md:B2sykrN8BlfpMKZYOa2
TLSH 6BC433D1BFA3F06683AD680664DCD37148E130F618A84E81CADC845CDB53D7EE725AB5
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "PANISA - SINTOP <bkk1@sintop.co.th>" (likely spoofed)
Received: "from postfix-inbound-6.inbound.mailchannels.net (inbound-egress-5.mailchannels.net [199.10.31.237]) "
Date: "15 Nov 2020 21:49:05 -0800"
Subject: "SOA TILL October 2020"
Attachment: "SOA OCTOBER 2020.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f6c50e09e157a0247ecaabb79effa55c6855fb784b30c4c38502e07b24859842/
Threat name:
ByteCode-MSIL.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 10:44:20 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
17 of 29 (58.62%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=63cq4cpbk6qci7wkvo3z575flrufl63yjmymjq4falqhwjeftbba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f6c50e09e157a0247ecaabb79effa55c6855fb784b30c4c38502e07b24859842

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f6c50e09e157a0247ecaabb79effa55c6855fb784b30c4c38502e07b24859842

(this sample)

AgentTesla

Executable exe 0b0497a471a34be0ac2c4719719527d6a73b4a0ad0d7b8f43d9c9af5119ce9cd

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0b0497a471a34be0ac2c4719719527d6a73b4a0ad0d7b8f43d9c9af5119ce9cd
  
Dropping
AgentTesla

Comments