MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45fcf21f61fa5a09ba1981a71995a6180731378ab04cf1de72953455711e21a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45fcf21f61fa5a09ba1981a71995a6180731378ab04cf1de72953455711e21a9
SHA3-384 hash: 5d4d8b333185c0d2f9608df63543a3a954d9b3a0667dc11e81189fbfeaf201f4796add411957509f7b51f565e129756e
SHA1 hash: 7d6362c0eb173701fa12662f23adbd57ae35972b
MD5 hash: a0a740b6dbf5fc0ce336d7dd0272481f
humanhash: nineteen-quiet-hamper-idaho
File name:Sales Order PO34718.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:597'074 bytes
First seen:2020-10-22 06:09:48 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:XwsbFLoYldH2W2Ka2cciUaKwQoAwM2zaQ/Pv+bRT9uEDkwo4Q:XRRMoLabUaKS5zB/sfto/4Q
TLSH E0C42334311AAE421ABAFA537EFC562984E30BE704F6E23FC6D75DC4C09192258C547E
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: m.dada@alhattabcontracting.com
Subject: Sales Order PO34718
Attachment: Sales Order PO34718.arj (contains "Sales Order PO34718.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45fcf21f61fa5a09ba1981a71995a6180731378ab04cf1de72953455711e21a9/
Threat name:
ByteCode-MSIL.Trojan.Sudloader
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 17:24:51 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ix6peh3b7jnatoqzqgtrtfngdadtcn4kwbgpdxtssu2fk4i6eguq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 45fcf21f61fa5a09ba1981a71995a6180731378ab04cf1de72953455711e21a9

(this sample)

AgentTesla

Executable exe 6eced51e9e9f798e79627188c69026a06a576021d112c8b94ed517f2576b009f

  
Dropping
MD5 31314b388f243437c1afccb13ab60a01
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6eced51e9e9f798e79627188c69026a06a576021d112c8b94ed517f2576b009f

Comments