MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48d5f5a05fbb56245f27658f81b8783e47a4d2723edf809dcf164929ffe6b2de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48d5f5a05fbb56245f27658f81b8783e47a4d2723edf809dcf164929ffe6b2de
SHA3-384 hash: d444dbfe3a0edadafc856c19f097ce238dc61454fd51ca0999882dea3e51800115c835b3e52bf16aa73e55d0d4a8feb9
SHA1 hash: f42def8829b5f0906add15fe460efac01c5103cc
MD5 hash: 3ed054d36eb8ac11d1dc2bf8dd448661
humanhash: hot-victor-salami-social
File name:purchase_order_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:452'672 bytes
First seen:2021-02-09 12:17:52 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:sQCn/ufrRdAPUdVQbhSafrEon1DAdlBNsbk7gX:c/MvVV0h19pAFNSlX
TLSH 39A423CEC2820C4384D628BE07158F2BE51D8F76A6AC07F67511A7D7AE71E87B151B83
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Simon Teo" <wholesale@greddy.com>" (likely spoofed)
Received: "from greddy.com (unknown [103.141.138.120]) "
Date: "09 Feb 2021 03:57:11 -0800"
Subject: "RE: PO#4995039"
Attachment: "purchase_order_pdf.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/48d5f5a05fbb56245f27658f81b8783e47a4d2723edf809dcf164929ffe6b2de/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 12:18:09 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jdk7lic7xnlcixzhmwhydodyhzd2jutsh3pybhopczest77gwlpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/48d5f5a05fbb56245f27658f81b8783e47a4d2723edf809dcf164929ffe6b2de

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 48d5f5a05fbb56245f27658f81b8783e47a4d2723edf809dcf164929ffe6b2de

(this sample)

AgentTesla

Executable exe 099373f725f9e86956223d5ef4a3a4fcd96f6a531e55447441ce8ccf7be5ee49

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 099373f725f9e86956223d5ef4a3a4fcd96f6a531e55447441ce8ccf7be5ee49
  
Dropping
AgentTesla

Comments