MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 11c86661d80688608a0cf9374e99f6cd80c675f01cfb5db71f1997779992d744. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 11c86661d80688608a0cf9374e99f6cd80c675f01cfb5db71f1997779992d744
SHA3-384 hash: 1d4798bd61b72924b47067d8a5a194a9093cefc8a8ee17786943d403024da29ea4b34b76a55d148f4ad57eee866df56b
SHA1 hash: a07a6027c37a5158fe01dd37f56008785a6e9d99
MD5 hash: e3c5d80142fdfc42c017840fbd5c9279
humanhash: uranus-one-solar-low
File name:Purchase Order 1674,pdf.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:787'998 bytes
First seen:2020-11-05 06:55:44 UTC
Last seen:2020-11-05 10:11:59 UTC
File type: zip
MIME type:application/zip
ssdeep 24576:0ygmvlBQjJfRonPS2fnigu3rbzlZ7Vv33Su:0ILWpoz0XzlZV33Su
TLSH A6F4230717F4B651B4B5350FF00C902EB7AD7ADD9AAA41F8A9F34E81A518D1BDA720CC
Reporter cocaman
Tags:AgentTesla xz


Avatar
cocaman
Malicious email (T1566.001)
From: "Carla Sheldon <yuksel@empy.com.tr>"
Received: "from empy.com.tr (unknown [160.20.147.147]) "
Date: "04 Nov 2020 13:09:32 -0800"
Subject: "PO1674 - 1 container mix"
Attachment: "Purchase Order 1674,pdf.xz"

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.26176.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/11c86661d80688608a0cf9374e99f6cd80c675f01cfb5db71f1997779992d744/
Threat name:
ByteCode-MSIL.Trojan.DnInject
Create hunting rule
Status:
Malicious
First seen:
2020-11-04 21:08:52 UTC
File Type:
Binary (Archive)
Extracted files:
46
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=chegmyoya2egbcqm7e3u5gpwzwamm5pqdt5v3ny7dglxpgms25ca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 11c86661d80688608a0cf9374e99f6cd80c675f01cfb5db71f1997779992d744

(this sample)

AgentTesla

Executable exe 0b741b53e9abfd7d5147eff7fa963976a776e8bedb99d08ae6e7288525823a59

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0b741b53e9abfd7d5147eff7fa963976a776e8bedb99d08ae6e7288525823a59
  
Dropping
AgentTesla

Comments