MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a87cb832286cd46299d51045054aecf69b3a7898a7bef464531f9f9d370e9c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 2 File information 4 Yara 4 Comments

SHA256 hash: 2a87cb832286cd46299d51045054aecf69b3a7898a7bef464531f9f9d370e9c6
SHA3-384 hash: cc046cf78cdf04b67ea4ffad1b8e1eca0f5682d8a0349175494110f592fef6f8d633d425a9fe2f148da83cef0817980b
SHA1 hash: 48246b5645cf749112b658ec06d8d1b9bade96a8
MD5 hash: 479b90f3d9a4280973b7a0f9d6cdbb0e
humanhash: skylark-mars-paris-wisconsin
File name:shipping documents.pdf.exe
Download: download sample
Signature AgentTesla
File size:416'256 bytes
First seen:2020-06-30 06:06:52 UTC
Last seen:2020-06-30 14:20:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 12288:YlClyB8cYxhybQYZATIam4nzgjyGEh+zvm:YlClyWcY+bQYeTsO3hX
TLSH E694123573BA8B21D6FA93B604B128250FF9AD2B6721D32E5C8091DE1973B14DB61F13
Reporter @jarumlus


Mail intelligence
Trap location Impact
CH Switzerland Low
Global Low
NL Netherlands Low
# of uploads 3
# of downloads 28
Origin country US US
CAPE Sandbox Detection:AgentTeslaV2
CERT.PL MWDB Detection:agenttesla
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Agensla
First seen:2020-06-30 06:08:07 UTC
AV detection:23 of 31 (74.19%)
Threat level:   2/5
Spamhaus Hash Blocklist :Suspicious file
Hatching Triage Score:   10/10
Malware Family:agenttesla
Tags:spyware keylogger trojan stealer family:agenttesla
VirusTotal:No data

Yara Signatures

Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Rule name:win_agent_tesla_g2
Author:Daniel Plohmann <>
Rule name:win_agent_tesla_w1
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe 2a87cb832286cd46299d51045054aecf69b3a7898a7bef464531f9f9d370e9c6

(this sample)

Delivery method
Distributed via e-mail attachment