MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fecabd98434bc5436db2259cf904205dff7b0d91a41802d7411d3a47618a3212. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fecabd98434bc5436db2259cf904205dff7b0d91a41802d7411d3a47618a3212
SHA3-384 hash: ffdd965d6f05d2e3eba0f9be677605f8b8e7e631aaf29b4b80e5519a8c195210b0d99ea5ccc74a727af8166da8d8c02a
SHA1 hash: 7714eb065be34a26f692126e7cbae6d6fa5150ed
MD5 hash: 7db346724c38b92fd6b215f2da1b899f
humanhash: november-undress-kilo-vegan
File name:NEW PO FROM ALANTECH MACHINERY CO.,LTD QTTY (PO#7A68D20).pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:414'006 bytes
First seen:2020-06-08 05:44:34 UTC
Last seen:2020-06-08 08:42:35 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:jXrBAaPkYBPtnMS/azXetozI+8t38ZZevfKdWoA:jXmaPkrJbemzI+43C1dzA
TLSH 499423D15DDAB7467DC65A815E36C344A8B01BF769CE73A0049BF8FC3DDBA072610891
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: Chusui <sales@tzdegree.com>
Received: from tzdegree.com (unknown [78.129.132.154])
Date: 8 Jun 2020 06:45:41 +0100
Subject: NEW PO FROM ALANTECH MACHINERY CO.,LTD QTTY (PO#7A68D20),
Attachment: NEW PO FROM ALANTECH MACHINERY CO.,LTD QTTY (PO#7A68D20).pdf.gz

Intelligence

File Origin
# of uploads :
4
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200609-0823.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 04:45:05 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=73fl3gcdjpcug3nsewopsbbalx7xwdmruqmafv2bdu5eoymkgija._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz fecabd98434bc5436db2259cf904205dff7b0d91a41802d7411d3a47618a3212

(this sample)

AgentTesla

Executable exe 85da156a6a3f7183f64066a1cabc2adf61ff011834f81495e52bdc2cbc047965

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85da156a6a3f7183f64066a1cabc2adf61ff011834f81495e52bdc2cbc047965
  
Dropping
AgentTesla

Comments