MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fdd33168c0960682e67b1731de4a6552f9fa7e80d5f889eb601c71ebe30e09ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fdd33168c0960682e67b1731de4a6552f9fa7e80d5f889eb601c71ebe30e09ba
SHA3-384 hash: dc1c78e1cbfc33df0157da095afa09df8c8962a60d9d5d3ce05dee1f7210b498c4f0792845f155cd6f06fe08a237a539
SHA1 hash: 9ae7ad6a9251fd0b86158d45795357d1f06407b0
MD5 hash: 5b711c03a1d0832413902ec6a65b8f89
humanhash: orange-blue-potato-red
File name:PO No. 2995_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:12'738 bytes
First seen:2021-02-24 07:03:13 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 384:Zstj0U4MFHeVjwyBIR5BPIhKVLqSmwr6O:ZsiN4+CyA5BPDm7O
TLSH 1742C046FD7608F76739325F5A07CB29328DF1710ADC485AF61A206637F27A66F0250B
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: seconline.com.au
Sending IP: 103.99.1.140
From: info@seconline.com.au
Reply-To: jamesadny@hotmail.com
Subject: RFQ No. 1061-01/02/03/1072-01/02/03 Purchase Order No. 2995/3010/2957 Dtd. 18.02.2021.
Attachment: PO No. 2995_pdf.gz (contains "PO No. 2995_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27434.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fdd33168c0960682e67b1731de4a6552f9fa7e80d5f889eb601c71ebe30e09ba/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-24 07:04:15 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7xjtc2gasydifzt3c4y54stfkl47u7ua2x4it23adry6xyyobg5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz fdd33168c0960682e67b1731de4a6552f9fa7e80d5f889eb601c71ebe30e09ba

(this sample)

AgentTesla

Executable exe f14d7b8fe3caf1abed6941ba3a7cfbc7496edb3ca728a4c1060e306e7087ec61

  
Dropping
MD5 d898f5565b17deaaed1752db7470cf88
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f14d7b8fe3caf1abed6941ba3a7cfbc7496edb3ca728a4c1060e306e7087ec61

Comments