MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd191f1f713eaa7a1fba99ad111ade0d53c5856fad985a7c119fac89af61f915. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd191f1f713eaa7a1fba99ad111ade0d53c5856fad985a7c119fac89af61f915
SHA3-384 hash: df1973764460bc241c2eef0eeea09225730cd3b0098c2a831858985ba8b7504f3b8f69f3a2a5792f717979728f557e81
SHA1 hash: 87f3dbd34580f961da16a8c2da4c4c300585eeff
MD5 hash: 43af64232bd49e01b5c59b299bdb19ea
humanhash: football-floor-kansas-michigan
File name:PO-058697098-JAN-Order,pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:847'240 bytes
First seen:2021-01-18 08:29:15 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 24576:jmfaUAkEvnpCSjx4js9t4ztP8/0dK4mqrwj2qNUp3:j+AkEvxjejICzi/0mqDqSx
TLSH 740533C0D26F378568206B64CA4FE5BA9B1506332EA1FF8D9146F5D8CB0E91B12630F7
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail-smail-vm49.hanmail.net
Sending IP: 203.133.180.237
From: 公司询价 <913005@hanmail.net>
Subject: 紧急：RFQ/采购订单/ January Order
Attachment: PO-058697098-JAN-Order,pdf.gz (contains "PO-058697098-JAN-Order,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd191f1f713eaa7a1fba99ad111ade0d53c5856fad985a7c119fac89af61f915/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 08:30:12 UTC
AV detection:
11 of 45 (24.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zumr6h3rh2vhuh52tgwrcgw6bvj4lblpvwmfu7art6witl3b7ekq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cd191f1f713eaa7a1fba99ad111ade0d53c5856fad985a7c119fac89af61f915

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz cd191f1f713eaa7a1fba99ad111ade0d53c5856fad985a7c119fac89af61f915

(this sample)

AgentTesla

Executable exe d8d17b08f8e18672119192f31fd6cf3f67c7772ca7afd4ff8f752bf1d825a046

  
Dropping
MD5 c07e64d8b7cfdec3aaeeb6c20b46f8e6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d8d17b08f8e18672119192f31fd6cf3f67c7772ca7afd4ff8f752bf1d825a046

Comments