MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69a9fd6f92c0242342ca657c9e1b87422465e725edc4578560e293edcdaa1d8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69a9fd6f92c0242342ca657c9e1b87422465e725edc4578560e293edcdaa1d8d
SHA3-384 hash: 8e1fb74e2f10d4ccebfe85740b2e337c522d02eb0202531ac0dcec5ca5fc938413f36f90f5420f0833781519f4b9b140
SHA1 hash: 00eb583a193f777d87ffd1564afda7137cb8473c
MD5 hash: 3cf12c29af5a01c56e13ca5fd0cdcc15
humanhash: april-speaker-leopard-asparagus
File name:PO_645768,PDF.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:829'584 bytes
First seen:2021-01-18 08:29:38 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 24576:AtWvL0Nk+tkmwps4/1RydtYzvOXGypZi1VT+:AkvQNk+tk1/1IzGm7c+
TLSH 080533CB3C16D0D95A922F66A8F7F8CF173711F2810212FE15676DEDA09E1C9119D0B9
Reporter abuse_ch
Tags:geo gz KOR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail-smail-vm43.hanmail.net
Sending IP: 203.133.180.231
From: 한인식 <insikh@hanmail.net>
Subject: Re; Re; PO / K＆K付款清單3
Attachment: PO_645768,PDF.gz (contains "PO_645768,PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69a9fd6f92c0242342ca657c9e1b87422465e725edc4578560e293edcdaa1d8d/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 08:30:14 UTC
AV detection:
10 of 45 (22.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ngu7234syascgqwkmv6j4g4hiisglzzf5xcfpbla4kj63tnkdwgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/69a9fd6f92c0242342ca657c9e1b87422465e725edc4578560e293edcdaa1d8d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 69a9fd6f92c0242342ca657c9e1b87422465e725edc4578560e293edcdaa1d8d

(this sample)

AgentTesla

Executable exe a999337cee8877bdb74fd8a623efc9b01ec3bda804eb0cc3700bc8208e163959

  
Dropping
MD5 126bc5080686def5a60e52484af1b63d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a999337cee8877bdb74fd8a623efc9b01ec3bda804eb0cc3700bc8208e163959

Comments