MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 011f529dbfb288bc648b57b4e53e2fe7e5fec2e2f4495cc91c6732658fd5c8bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 011f529dbfb288bc648b57b4e53e2fe7e5fec2e2f4495cc91c6732658fd5c8bb
SHA3-384 hash: 95648f8527f2b969bf0be82bf8dde39bce45fbe71abec4b7dcd33055021e552c57916a287d72a5c5d6d7473d10267cde
SHA1 hash: 15b2b72565d9bcd90f1e9764fdeb6d3ad05909b7
MD5 hash: 71ef3cd933193def0190bdb55903e37b
humanhash: uranus-carbon-beer-angel
File name:new Order no. 631701 - send PI.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:674'397 bytes
First seen:2021-03-26 06:34:05 UTC
Last seen:2021-03-29 15:45:06 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:bABpjAN+GjlHoQTk9HrMoPuUVcFgB9lDvjtd1Tf4VXi4v0HE:Z+GrkR7WU6gTlbpPzK0k
TLSH 57E42347CC84D504CBF897CB684E6590C1AE30353BCDFD551669AB160BABC66F8A08FB
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: ""Paul D�sterbeck [MADER Hamburg GmbH]"<dr.ken@kentax.gr.jp>" (likely spoofed)
Received: "from kentax.gr.jp (kentax.gr.jp [111.89.145.111]) "
Date: "Fri, 26 Mar 2021 03:56:00 +0100"
Subject: "Our new Order no. 631701"
Attachment: "new Order no. 631701 - send PI.gz"

Intelligence

File Origin
# of uploads :
9
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.598.4805.22733.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Link:
https://labs.inquest.net/dfi/sha256/011f529dbfb288bc648b57b4e53e2fe7e5fec2e2f4495cc91c6732658fd5c8bb
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/011f529dbfb288bc648b57b4e53e2fe7e5fec2e2f4495cc91c6732658fd5c8bb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-26 04:48:50 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aepvfhn7wkelyzelk62okprp47s75qxc6revzsi4m4zgld6vzc5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/011f529dbfb288bc648b57b4e53e2fe7e5fec2e2f4495cc91c6732658fd5c8bb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 011f529dbfb288bc648b57b4e53e2fe7e5fec2e2f4495cc91c6732658fd5c8bb

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments