MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3a7f05f0794da67d558b6faeacee301a223197b6d68989930cbdbcda09fb7ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e3a7f05f0794da67d558b6faeacee301a223197b6d68989930cbdbcda09fb7ac
SHA3-384 hash: 0ddca7b13f8acb856d0827832b5ba171a52ba8c7c2f29f8ebceb7808dfe7435c759a3b2c96cede411a234c623c59daba
SHA1 hash: 13733235bd3e86a6b1c49bc3bbebf6dd546edf09
MD5 hash: fdc2eabc10fddb3faa42d9195e485b0e
humanhash: sierra-april-uniform-sixteen
File name:Shipping Documents PL&BL draft(1).img.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:448'061 bytes
First seen:2020-04-02 04:28:10 UTC
Last seen:2020-04-02 05:24:41 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:g9oQ4q9zbHlGYNc07AQ+6rJ+PQIwAyvacW4N4cq6:g9oQzDMM1pJ+uAYlW42h6
TLSH 1C9423F7771DA2A981EA8B65A71897213E401C5F8F94FE730F1117E394828EB9A3D0D4
Reporter cocaman
Tags:AgentTesla gz

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.AgenslaNET.1.8889.14719.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-01 22:22:11 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
20 of 47 (42.55%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4ot7axyhstngpvkyw35ovtxdagrcggl3nvujrgjqzpn43ie7w6wa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e3a7f05f0794da67d558b6faeacee301a223197b6d68989930cbdbcda09fb7ac

(this sample)

AgentTesla

Executable exe 0068cd1c85fc05f425fc6213b8317b2827528285d1a73b7df6135123161448ee

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0068cd1c85fc05f425fc6213b8317b2827528285d1a73b7df6135123161448ee

Comments