MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1abb5028eeb91c7f4026a8d048f1c6d4d44e45c2bb85368f2ad824e6f675e0ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1abb5028eeb91c7f4026a8d048f1c6d4d44e45c2bb85368f2ad824e6f675e0ac
SHA3-384 hash: c6d4787eee0bb9a3991d5b5fcba1c708785870ebb3d23c0d2cd280161b24e35d8aa404bec84f8a11f60698d58ff9b159
SHA1 hash: 9fd159e257e2e8fb90d791fff44a522e0361805e
MD5 hash: 9dd3d95f105152b43f14c5bb8110b744
humanhash: victor-quebec-nevada-zulu
File name:NEW ORDER.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:567'284 bytes
First seen:2021-02-24 15:35:10 UTC
Last seen:2021-02-26 03:20:13 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:uLb2zEQhQSye7TkhA4k2oPN6niwoixyMGAUSfqVmUV:uGEQKSyekhiDM8yKpV
TLSH 9EC423321917803C390A527FBCD185853034621B7E6ACBAB7EE5B6D5BD258CC8E64CF5
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
3
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs268.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.24016.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21103.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1abb5028eeb91c7f4026a8d048f1c6d4d44e45c2bb85368f2ad824e6f675e0ac/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 15:37:29 UTC
AV detection:
18 of 47 (38.30%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dk5vakhoxeoh6qbgvdier4og2tke4rocxoctndzk3ason5tv4cwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1abb5028eeb91c7f4026a8d048f1c6d4d44e45c2bb85368f2ad824e6f675e0ac

(this sample)

AgentTesla

Executable exe 254b1698e53cc78f579d9fa798a0c5b770321b47c99d6c580b7a7708f6cb01cb

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 254b1698e53cc78f579d9fa798a0c5b770321b47c99d6c580b7a7708f6cb01cb
  
Dropping
MD5 b2beac2989e5c1b3afc974b31e3c62a6

Comments