MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1969ced55332f3dc6e113d3585c87b075890248a32c2149e06d8f5ed0c7fc324. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1969ced55332f3dc6e113d3585c87b075890248a32c2149e06d8f5ed0c7fc324
SHA3-384 hash: 45a379ebb4e56cb72b9c69bf184b80686b9b183cb2706cf49e28bf31f884aef78cb7a9477e93640bb75decfff14cf9dd
SHA1 hash: c971b6165bf83fc9082ffd4c4cc60df8a06e56f9
MD5 hash: 3d8d36a9e09e8141c3260fd8cbe3e3c1
humanhash: charlie-fish-burger-gee
File name:Pending Order Confirmation.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:598'783 bytes
First seen:2020-11-26 07:05:10 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:P0gBix3EVS8xijtrwKmifTy+uyuBn7pq+y4T6QY4EU00NaMMGZ:PbgQg/Hnjvr4Y/H0N6o
TLSH A9D423519ACC90F1B2568B4F5A38646D9CA6152F50BF52B300E1138BC5BC64FE7E07FA
Reporter cocaman
Tags:gz


Avatar
cocaman
Malicious email (T1566.001)
From: "Habibur Rahman <Info@habibur.rahman>" (likely spoofed)
Received: "from shared.safavisa.com (shared.safavisa.com [89.163.146.180]) "
Date: "Thu, 26 Nov 2020 02:14:30 +0100"
Subject: "Pending Order Confirmation"
Attachment: "Pending Order Confirmation.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1969ced55332f3dc6e113d3585c87b075890248a32c2149e06d8f5ed0c7fc324/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-26 07:06:05 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dfu45vktglz5y3qrhu2ylsd3a5mjajekglbbjhqg3d262dd7ymsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 1969ced55332f3dc6e113d3585c87b075890248a32c2149e06d8f5ed0c7fc324

(this sample)

AgentTesla

Executable exe ae6c488302c04f00a60835db6b955fb8e1eb42f0e73e71873f5b7dc630596755

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ae6c488302c04f00a60835db6b955fb8e1eb42f0e73e71873f5b7dc630596755

Comments