MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14ff14f01dbdd25fa438abb57376747a312007166d6eb67b778918582da01002. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14ff14f01dbdd25fa438abb57376747a312007166d6eb67b778918582da01002
SHA3-384 hash: 063355e6e561704e238cec96c61c74b62ab1f9a6843ffaa9d5acf916154c97b5ab93dc03379a5e75e8e3965217fabf85
SHA1 hash: b6a5aa69b63243a0fb6c7051bdcd120a944eecba
MD5 hash: 2856f88478dc39b95425f61091dd1105
humanhash: carpet-michigan-solar-carolina
File name:334# ARD_QUOTATION (2).PDF.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:337'522 bytes
First seen:2021-04-20 11:32:52 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:lIq+h5h4tNnzX7R7bsLRIAedfmkuk/PQfB7h4VfSv5Bys89neEYBTwoONWUHwF:lIqcWND7lbsLaAehmkAf7lBys8dmT8Nm
TLSH 01742360F41C8086E3D2CE7E1DFE2EAEDE5021C6817801F7665DCE4A1C87245DB9BA27
Reporter cocaman
Tags:AgentTesla z


Avatar
cocaman
Malicious email (T1566.001)
From: "Angeli Alessandro <Alessandro.Angeli@gea.com>" (likely spoofed)
Received: "from gea.com (unknown [103.153.183.148]) "
Date: "20 Apr 2021 02:15:09 -0700"
Subject: "Re: RFQ QUOTATION REF. 334#"
Attachment: "334# ARD_QUOTATION (2).PDF.z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14ff14f01dbdd25fa438abb57376747a312007166d6eb67b778918582da01002/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ct7rj4a5xxjf7jbyvo2xg5tupiysabywnvxlm63xremfqlnacaba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/14ff14f01dbdd25fa438abb57376747a312007166d6eb67b778918582da01002

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 14ff14f01dbdd25fa438abb57376747a312007166d6eb67b778918582da01002

(this sample)

AgentTesla

Executable exe 49dfecc9b9d122b59de9c748c4c86308d6666a707bcdefa910cf9be7780b68bc

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 49dfecc9b9d122b59de9c748c4c86308d6666a707bcdefa910cf9be7780b68bc
  
Dropping
AgentTesla

Comments