MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19e1ec154414c1782b9c45e154ca0cc15333dc0c5bdd03227800e9b5d4f5da04. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19e1ec154414c1782b9c45e154ca0cc15333dc0c5bdd03227800e9b5d4f5da04
SHA3-384 hash: 5d960baeed813a1a2a71cb2077dc6d2753ce9ff57e66b9008d5c4f581647fb9a8d78c5c69cdb149c6b20c7e5dcf9b013
SHA1 hash: 91dcb4a246b688b48d642c5e285094af110477a3
MD5 hash: 544b6fb62b9c592acce8ec5979f437c0
humanhash: uranus-equal-blossom-tennessee
File name:New PO.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:587'940 bytes
First seen:2021-02-17 03:04:42 UTC
Last seen:2021-02-18 04:57:41 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:Yt9O81z0f8Ck+u3C1HkP+TI+i8g25z6n6RZweq/8IMxqk3NRfw1aVBKa4V2N:YDKfBQC1HhTIZ2563Mqk34sKa9N
TLSH D5C43358FC0D0B8FDC35373A2029A97CEC6DD89B11621613A1FF9B436E8C1BA4D96745
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
6
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1108.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/19e1ec154414c1782b9c45e154ca0cc15333dc0c5bdd03227800e9b5d4f5da04/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-16 16:18:26 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dhq6yfkectaxqk44ixqvjsqmyfjthxamlpoqgityadu3lvhv3ica._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/19e1ec154414c1782b9c45e154ca0cc15333dc0c5bdd03227800e9b5d4f5da04

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 19e1ec154414c1782b9c45e154ca0cc15333dc0c5bdd03227800e9b5d4f5da04

(this sample)

AgentTesla

Executable exe 1147da78f52d880376bf4e7c1a6833dbef0003f90e4eb2c2bcae2fb99e18ed78

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1147da78f52d880376bf4e7c1a6833dbef0003f90e4eb2c2bcae2fb99e18ed78
  
Dropping
MD5 74bc1e0732a232688d75d37b28964eed

Comments