MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31c7a172c119c906515700c843fef30c007d148c2ee67d89f4e3f88579696987. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31c7a172c119c906515700c843fef30c007d148c2ee67d89f4e3f88579696987
SHA3-384 hash: 7509a23ae8163e8685a8ae3438d8d235b945974f936b1e387cfee8c9db3b66faa5aa3a03c4f2ae8c2ff870c7c0525307
SHA1 hash: bb702ada8b52294de9e8e8a7f69e6c53f68f9fef
MD5 hash: e3374628150ddd998f5f064067f57332
humanhash: delta-mirror-tango-mountain
File name:Ningbo--Outstanding_Payments.exe.bz2.001
Download: download sample
Signature AgentTesla
Create hunting rule
File size:549'796 bytes
First seen:2021-05-28 12:27:12 UTC
Last seen:Never
File type: r01
MIME type:application/x-bzip2
ssdeep 12288:2RZiBd6Q6+0Mn/W1AeULPuEVZ4E3DTIsTjlvhVBQAOk:2aBo+BW1VULuIuE3DcsX7Rv
TLSH 59C4231A4392A1C18E9DDC295699E20801338BEC0FD726B5E3C9B96F3797E7042B17D9
Reporter cocaman
Tags:001 AgentTesla


Avatar
cocaman
Malicious email (T1566.001)
From: ""Tang, Xiaonan, Account Dept"<Xiaonan.Tang@grupoantolin.com>" (likely spoofed)
Received: "from grupoantolin.com (unknown [103.139.44.91]) "
Date: "28 May 2021 03:27:14 -0700"
Subject: "***Urgent!*** Ningbo--Outstanding payment for month end May,28"
Attachment: "Ningbo--Outstanding_Payments.exe.bz2.001"

Intelligence

File Origin
# of uploads :
1
# of downloads :
149
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/31c7a172c119c906515700c843fef30c007d148c2ee67d89f4e3f88579696987/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-05-28 12:28:10 UTC
File Type:
Binary (Archive)
Extracted files:
60
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ghd2c4wbdheqmukxadeeh7xtbqah2femf3th3cpu4p4ik6ljngdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/31c7a172c119c906515700c843fef30c007d148c2ee67d89f4e3f88579696987

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r01 31c7a172c119c906515700c843fef30c007d148c2ee67d89f4e3f88579696987

(this sample)

AgentTesla

Executable exe e6d9a4125141479180f19f967af7393982b3db0c32916627928ca137be36500c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e6d9a4125141479180f19f967af7393982b3db0c32916627928ca137be36500c
  
Dropping
AgentTesla

Comments