MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 206ce78e2121b993b48ba2aa66b6a3fa1a2dfb9722cb4968091a3e95c9920c0d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 206ce78e2121b993b48ba2aa66b6a3fa1a2dfb9722cb4968091a3e95c9920c0d
SHA3-384 hash: 32733a1334714ba7e1af8a85abcf2657cf0e30b847cf560a790c95a65daa876db8e5b1586f5fc6d15b0710794100aa95
SHA1 hash: f4bc9737154d161f51389bd5421720893727c1c2
MD5 hash: 333de180ebe96169ac6f7d70353e3cda
humanhash: avocado-sad-moon-twelve
File name:Payment Advice document copy.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:454'486 bytes
First seen:2020-07-24 06:21:55 UTC
Last seen:2020-07-25 10:38:01 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:94ylNoarcDbN0d82NDZVRFrQg/7nfDPTa7sw8kzoroMK+:9RSazd82NDZVRFrQAnfD7aY5corVp
TLSH B3A42360499E388BFEC9F3CA61CB7578993CF868233848D5D13B4A8050F36B69DE9D51
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
4
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.20774.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/206ce78e2121b993b48ba2aa66b6a3fa1a2dfb9722cb4968091a3e95c9920c0d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-23 16:17:57 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ebwopdrbeg4zhnelukvgnnvd7inc364xelfus2ajdi7jlsmsbqgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/206ce78e2121b993b48ba2aa66b6a3fa1a2dfb9722cb4968091a3e95c9920c0d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 206ce78e2121b993b48ba2aa66b6a3fa1a2dfb9722cb4968091a3e95c9920c0d

(this sample)

AgentTesla

Executable exe b011c7b2e125208040a905a4d5f5d6394d03fb3d6b0b4333e722a12dad2ce7a6

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b011c7b2e125208040a905a4d5f5d6394d03fb3d6b0b4333e722a12dad2ce7a6
  
Dropping
MD5 904623f233cd63577c9a5d02f39aeaa2

Comments