MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e46c402441b60a68b54c18cb6e1a1b176e5e9b5b1c836f0d06f590bc834f452. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e46c402441b60a68b54c18cb6e1a1b176e5e9b5b1c836f0d06f590bc834f452
SHA3-384 hash: 389b361d7027765473ec6dfae848594034a2c10cc5ea1c1fadec9aa3fa4de663dd6cf3f9e32d9d0e619ee8be65d4db61
SHA1 hash: a9ed362ed57fb8621e84d4e9ccff7a6b855e5b92
MD5 hash: 40bafbba22e71140c0b89b894235b745
humanhash: blossom-stream-kentucky-quiet
File name:Purchase Order.gz.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:405'613 bytes
First seen:2020-06-16 05:18:15 UTC
Last seen:2020-06-16 11:36:21 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:UxbFV0PtnBLqAaTKqKjW0nuNxqQ9S4x5+L4Ypgj/9i28d9x5s6XwGwm4P5jVhegw:UNwb+VTK5XuNxqI+L4YpgI+7T5B4gWpj
TLSH 8C842372FB5A926C72B67FC8A5235EE6F854D21E3950C28AB470711BB12015F7A3DD30
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email
From: Sharifah Rashidah <rashidah@skyshine.com.my>
Received: from skyshine.com.my (unknown [185.222.58.143])
Date: 15 Jun 2020 12:15:23 -0700
Subject: =?UTF-8?B?5Li76aKYOiBOZXcgUHVyY2hhc2UgT3JkZXI=?=
Attachment: Purchase Order.gz.rar

Intelligence

File Origin
# of uploads :
2
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Sonbokli
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 05:20:06 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bzdmiasednqknc2uygglnynbwf3ol2nvwhedn4gqn5mqxsbu6rja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 0e46c402441b60a68b54c18cb6e1a1b176e5e9b5b1c836f0d06f590bc834f452

(this sample)

AgentTesla

Executable exe 1a15237891c202365373b5699d8de5f087da47b52690c70d9bd69d747e669799

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1a15237891c202365373b5699d8de5f087da47b52690c70d9bd69d747e669799
  
Dropping
AgentTesla

Comments