MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0494a953272a7203b705083ec85880b9460a8639e93071d713323facfdd24771. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0494a953272a7203b705083ec85880b9460a8639e93071d713323facfdd24771
SHA3-384 hash: e460834bb3168dcaab76345ad8f8bfc49300c5d6092120bb23fca1ee278c2adbc08d3b2639785263331363a3e9a111ac
SHA1 hash: e8b4158889e309bb5b7151111db4beac9f8b2149
MD5 hash: 18e1e45cbd1415d618b518e8ed2a9857
humanhash: black-crazy-mirror-papa
File name:PO.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:491'847 bytes
First seen:2021-04-02 09:07:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:HlfYv9HI78Z01ZHi2Xwh2ypxDq3kOEmOeI8EGjjV:Fw1ktZwa3kJmJ5p
TLSH A1A423B34F7A0EBCC099DD5BCC40D95405CEB2A49098ED88FAA1B97F775C6C68C219B4
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1137.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21241.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/0494a953272a7203b705083ec85880b9460a8639e93071d713323facfdd24771
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0494a953272a7203b705083ec85880b9460a8639e93071d713323facfdd24771/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2021-04-02 01:54:38 UTC
AV detection:
4 of 43 (9.30%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=askksuzhfjzahnyfba7mqweaxfdavbrz5eyhdvytgi72z7osi5yq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0494a953272a7203b705083ec85880b9460a8639e93071d713323facfdd24771

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0494a953272a7203b705083ec85880b9460a8639e93071d713323facfdd24771

(this sample)

AgentTesla

Executable exe 27f47dda959af174fb8d5dceb4d1abc99fa1f7c28160ee217a98f57bb03144be

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 27f47dda959af174fb8d5dceb4d1abc99fa1f7c28160ee217a98f57bb03144be
  
Dropping
MD5 1d4ce470661ccff7d1cf20564a253d92

Comments