MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4f7149eac37b2c86da81e017c4f8e7cbb4471d4c75b0a4e2fb886b99b40a527. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4f7149eac37b2c86da81e017c4f8e7cbb4471d4c75b0a4e2fb886b99b40a527
SHA3-384 hash: d1a28698b24f695845ec58418cfc2b3273421fa3943b2c6dbcdbaca8c4c6055439d4958700920086e85579582293f71e
SHA1 hash: 2f3783f5903aa3f1d93db828b3b6e5f024aba6c2
MD5 hash: 67be75d5cc59c752a638f494dcf8b2cb
humanhash: cola-bulldog-mango-washington
File name:PO AA21C04U3101-MTXGA6_PDF.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:469'062 bytes
First seen:2021-04-08 07:03:01 UTC
Last seen:2021-04-08 13:36:28 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:p60G46K/hOnJhA19ZKZ+Lbc4vH+7KduXK+:p046mhR7tnc4r8K+
TLSH 39A423389CB3A9EC961438DDC1E6190C4380506F907FB3678B74A54DFCAB0BF64469BA
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: agarwalpipe.com
Sending IP: 45.144.225.211
From: Elie Abdel Ahad <ritesh@agarwalpipe.com>
Subject: Re: NEW ORDER
Attachment: PO AA21C04U3101-MTXGA6_PDF.gz (contains "PO AA21C04U3101-MTXGA6_PDF.exe")

Intelligence

File Origin
# of uploads :
3
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4f7149eac37b2c86da81e017c4f8e7cbb4471d4c75b0a4e2fb886b99b40a527/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 04:21:22 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wt3rjhvmg6zmq3nidyaxyt4ops5ui4ouy5nqutrpxcdltg2auutq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/b4f7149eac37b2c86da81e017c4f8e7cbb4471d4c75b0a4e2fb886b99b40a527

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz b4f7149eac37b2c86da81e017c4f8e7cbb4471d4c75b0a4e2fb886b99b40a527

(this sample)

AgentTesla

Executable exe 600715af104a41db6d18d62a5980b87423f009eac1b1b96330e06e3cb3314637

  
Dropping
MD5 591c96d331d55c84ccb817c8957b63dd
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 600715af104a41db6d18d62a5980b87423f009eac1b1b96330e06e3cb3314637

Comments