MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4907f1abb5d963fd04d918c2315a7dbe9c037d30331ad10fd5861abd8c8cb383. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4907f1abb5d963fd04d918c2315a7dbe9c037d30331ad10fd5861abd8c8cb383
SHA3-384 hash: 3ff6614961710af5e6c36762dc4e4b12cd7e5f5f4fb7c06d234a9e820d95bf647b722d6e067de9a631aba47e604c844b
SHA1 hash: 89f741ec38f07836971da790ef3a36eeda746c06
MD5 hash: 610ab11505cebb9d8176f897e8af0568
humanhash: undress-pip-charlie-shade
File name:NEW ORDER PO.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:563'628 bytes
First seen:2020-11-04 17:26:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:lmuldrEVklW/XrO4eoytbdG/VS3lJS4fT9G/PZXYmTVE:IuTrFo/DNUG/VS3vS4foZIwVE
TLSH 36C423F2B1A85A703935D182BF5B91F79E9ACB8DC4B09F9775650480B7C21AAE483370
Reporter cocaman
Tags:AgentTesla z


Avatar
cocaman
Malicious email (T1566.001)
From: "Ta Thi Ngoc My <my.tathingoc@bitisgroup.vn>"
Received: "from bitisgroup.vn (unknown [37.48.85.240]) "
Date: "04 Nov 2020 05:10:52 -0800"
Subject: "NEW ORDER PO "
Attachment: "NEW ORDER PO.pdf.z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.424.10513.8639.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4907f1abb5d963fd04d918c2315a7dbe9c037d30331ad10fd5861abd8c8cb383/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-04 15:20:22 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jed7dk5v3fr72bgzddbdcwt5x2oag7jqgmnncd6vqynl3demwobq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4907f1abb5d963fd04d918c2315a7dbe9c037d30331ad10fd5861abd8c8cb383

(this sample)

AgentTesla

Executable exe ad60ff4ce8f71588503054bb8b84b2761fd138672bc9776276e72374ab4a1198

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ad60ff4ce8f71588503054bb8b84b2761fd138672bc9776276e72374ab4a1198
  
Dropping
AgentTesla

Comments