MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab7d470e4e2d925f8cfc10b91b57105d21bab0f94c7197c228aa14cc71c83ac1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab7d470e4e2d925f8cfc10b91b57105d21bab0f94c7197c228aa14cc71c83ac1
SHA3-384 hash: a1e9d37f4b27dab75fd7920495060b8f481a4642cdf6c7e5bc246fe59c1711fbda3e1f3fe5fcd317e27a465f5c089604
SHA1 hash: a5fbf129eab492399309a8990e6e52a358cebc0c
MD5 hash: 40ebe13f25cecd4196d8eccd89af4df1
humanhash: delaware-table-robert-blue
File name:SHIPPING DOCUMENTS pdf.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:513'557 bytes
First seen:2020-07-01 14:36:53 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 12288:5NY/dN+Wixb3rnAHmM78bnKiLgHcKdLmmclO6eWM5Dk:5sd9iRi7izLAHLLFzDk
TLSH EAB4239936C822D4BCE3AD47FA1EA67C24EB5CC2E645CEB4CF0593E443491C608DBB95
Reporter cocaman
Tags:xz


Avatar
cocaman
Malicious email
From: Eleora Engineers <payment@buddiesholidays.in>
Received: from 142-4-22-49.unifiedlayer.com (142-4-22-49.unifiedlayer.com [142.4.22.49])
Date: Wed, 01 Jul 2020 06:53:16 -0600
Subject: SHIPPING DOCUMENTS
Attachment: SHIPPING DOCUMENTS pdf.xz

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27342.RarHeur.v5.HideExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab7d470e4e2d925f8cfc10b91b57105d21bab0f94c7197c228aa14cc71c83ac1/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-07-01 07:11:08 UTC
File Type:
Binary (Archive)
Extracted files:
76
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vn6uodsofwjf7dh4cc4rwvyqluq3vmhzjryzpqrivikmy4oihlaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz ab7d470e4e2d925f8cfc10b91b57105d21bab0f94c7197c228aa14cc71c83ac1

(this sample)

AgentTesla

Executable exe fc5c1b1b5ea0f43d529c28711f09ae39010969e2af69905ddb8ad294158d57c7

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fc5c1b1b5ea0f43d529c28711f09ae39010969e2af69905ddb8ad294158d57c7

Comments