MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1681babf40425d8edd012d05bc819ce1ef9d48ef55318acc3d29e56a8a649423. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1681babf40425d8edd012d05bc819ce1ef9d48ef55318acc3d29e56a8a649423
SHA3-384 hash: 28381b2f22b9fdf2029d76d0e107739902ebac09ce4dedb5ae7510cafe440afe1314ae87debf907a144c2ffc3ebcd8a2
SHA1 hash: c5256c81b795586c9472a15353e26f72eff9fe61
MD5 hash: 27b0c67e6ea6cf8f4e6d7cdbce818f64
humanhash: fifteen-purple-winter-seven
File name:#100028153.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:724'255 bytes
First seen:2021-04-07 03:03:16 UTC
Last seen:2021-04-07 05:17:33 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:igYOMr4QRaPKzyX9WqdURiPWMJjZWv/dwAdnZWVRhcr8l4n4Fin:igSrxzbWURilJdW9won+UQcn
TLSH DEF42396D51FEA7C5B2EC8737F79F7C03388531931A91DA6C3188893832AD520E8DD5A
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisF2091A8EDC2C.9579.21162.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/1681babf40425d8edd012d05bc819ce1ef9d48ef55318acc3d29e56a8a649423
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1681babf40425d8edd012d05bc819ce1ef9d48ef55318acc3d29e56a8a649423/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 03:04:06 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c2a3vp2aijoy5xibfuc3zam44hxz2shpkuyyvtb5fhswvctesqrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.54
Link:
https://yomi.yoroi.company/submissions/1681babf40425d8edd012d05bc819ce1ef9d48ef55318acc3d29e56a8a649423

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1681babf40425d8edd012d05bc819ce1ef9d48ef55318acc3d29e56a8a649423

(this sample)

AgentTesla

Executable exe 1fcdd3e4723f498ec7e20fddc287aaddc0ac8858efeaceac6e098230b7efef9c

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1fcdd3e4723f498ec7e20fddc287aaddc0ac8858efeaceac6e098230b7efef9c
  
Dropping
MD5 f2091a8edc2c840635abdf9c0dfeb123

Comments