MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49d717fbc7294eb0931552246c97588751a81d1308a315b815b1fd0dda6427f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49d717fbc7294eb0931552246c97588751a81d1308a315b815b1fd0dda6427f8
SHA3-384 hash: 61fe8a838c4450503b6d51e2f6ef0472f18f1455c8f207ee51ad1824e43ac26d6a55a5451d2371f99724627d69f7d161
SHA1 hash: 66fb0622519d4ed3ed7c96ec151ff8b65b4f33e0
MD5 hash: 98de7af4876d16a56be4ac35eea6ba6b
humanhash: illinois-steak-washington-double
File name:Purchase Order.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:399'658 bytes
First seen:2020-12-03 07:29:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:TN193IcoQ5biyy2n4uXXXgQLQH8oHGGVLDMV/9GAgS8gUMNUlAZ8g6ZxJV:T5F7Vkm4uXHhg/qlGAH8gUMr8Zxb
TLSH 9F8423DF1478BF6CD793DA629F634B1331A7ACA48E62B594210B60834C5B81771A7C2E
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Sales-SGM Corporations <sales@sgmcorporations.com>" (likely spoofed)
Received: "from postfix-inbound-1.inbound.mailchannels.net (inbound-egress-6.mailchannels.net [199.10.31.238]) "
Date: "Thu, 03 Dec 2020 02:52:53 +0100"
Subject: "Purchase Order No.4500016774"
Attachment: "Purchase Order.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49d717fbc7294eb0931552246c97588751a81d1308a315b815b1fd0dda6427f8/
Threat name:
Win32.Trojan.EmotetAE
Create hunting rule
Status:
Malicious
First seen:
2020-12-03 07:30:16 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
19 of 46 (41.30%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jhlrp66hffhlbeyvkisgzf2yq5i2qhitbcrrloavwh6q3wtee74a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/49d717fbc7294eb0931552246c97588751a81d1308a315b815b1fd0dda6427f8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 49d717fbc7294eb0931552246c97588751a81d1308a315b815b1fd0dda6427f8

(this sample)

AgentTesla

Executable exe caa1844423cb2047c876df6276fd0e146f08e254897de3c9d51b1c41b3d35f13

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 caa1844423cb2047c876df6276fd0e146f08e254897de3c9d51b1c41b3d35f13

Comments