MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1b3231292a99e8386b1f209db7f5bad8ec94aa877bd87661dc0b1aa66664aab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1b3231292a99e8386b1f209db7f5bad8ec94aa877bd87661dc0b1aa66664aab
SHA3-384 hash: 902ea003891501e8e912a489249a9e06028e79d0d6a45dca1c58a35f82a3c042dc982a9e6c08525d226388f7d2a33335
SHA1 hash: 5e607f93d64428e3097ea787c8d3e46559da764c
MD5 hash: 5d628a5b99a82272b6e714b8420fd965
humanhash: angel-north-missouri-coffee
File name:New Order Quotation.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:465'132 bytes
First seen:2021-04-02 06:32:20 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:yYkcDUrW55Ik7WpFFpvBl8Cuq1yG653ydK1ASTA+Ou8wiKWJxgQ:yhcDtiFB7l1yG2CQiYAa8wiKWLR
TLSH CEA4231C881D39A44EF1728E341E6F375D3533C6A269C6486082CBBEF965D2E7A8D271
Reporter cocaman
Tags:gz


Avatar
cocaman
Malicious email (T1566.001)
From: "gerdautrading-co@hotmail.com" (likely spoofed)
Received: "from postfix-inbound-3.inbound.mailchannels.net (inbound-egress-5.mailchannels.net [199.10.31.237]) "
Date: "1 Apr 2021 16:13:06 -0700"
Subject: "Re: NEW ORDER FOR APRIL."
Attachment: "New Order Quotation.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1b3231292a99e8386b1f209db7f5bad8ec94aa877bd87661dc0b1aa66664aab/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2021-04-02 06:33:07 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ugzsgeusvgpihbvr6ie5w723vwhmssvio66yozq5ycy2uztgjkvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/a1b3231292a99e8386b1f209db7f5bad8ec94aa877bd87661dc0b1aa66664aab

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz a1b3231292a99e8386b1f209db7f5bad8ec94aa877bd87661dc0b1aa66664aab

(this sample)

AgentTesla

Executable exe acf30aabe0138a2fd83f455da4a9a3cb10c374e33b2ed7d4570a799f58e91028

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 acf30aabe0138a2fd83f455da4a9a3cb10c374e33b2ed7d4570a799f58e91028

Comments