MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f35f5f715048f97e425fcc3e8014150fd6c64d322218db86f722c85496b837f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f35f5f715048f97e425fcc3e8014150fd6c64d322218db86f722c85496b837f
SHA3-384 hash: d971ca2e267d598932d6ed11ffc715545e123fb613220a0f2a178aca3ac9ed2b69fd4f0cc162c8daad22c87866b38645
SHA1 hash: 5675f641ea614976c25df0a84980184943877443
MD5 hash: 06d715cd32a640e485ba8b00bffec13c
humanhash: kilo-apart-bacon-jig
File name:ORDER PROPOSAL 097263_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:670'128 bytes
First seen:2020-08-18 19:33:36 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:DBgoKv9XVAzt1fNSBmZ78dyDAasVPuPXH2J0uOWpNlGYuxNR:DdkyrYeIdGIOWDlGn
TLSH 86E4237A5810E1F66DC99691A37073D6A0DC3436F80ED4DB3938DCB77D31A878908E9A
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.ptjlg.co.id
Sending IP: 103.253.68.52
From:  Levis Andre <finance@ptjlg.co.id>
Subject: PRODUCT INQUIRY - ORDER PROPOSAL [#097263]
Attachment: ORDER PROPOSAL 097263_pdf.gz (contains "ORDER PROPOSAL 097263_pdf.exe")

AgentTesla SMTP exfil server:
mail.mahandor.com:587

AgentTesla SMTP exfil email address:
mike@mahandor.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f35f5f715048f97e425fcc3e8014150fd6c64d322218db86f722c85496b837f/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 13:30:27 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j427l5yvashzpzbf7tb6qakbkd6wyzgteiqy3odpoiwiksllqn7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4f35f5f715048f97e425fcc3e8014150fd6c64d322218db86f722c85496b837f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 4f35f5f715048f97e425fcc3e8014150fd6c64d322218db86f722c85496b837f

(this sample)

AgentTesla

Executable exe dfeb96d3bb1562a8f587db6407ca2da39f052452c134d41c47dce109bfc6d1b1

  
Dropping
MD5 60509a98fc3e2ee5636ef413002df0ca
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dfeb96d3bb1562a8f587db6407ca2da39f052452c134d41c47dce109bfc6d1b1

Comments