MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c11b6eb5f9c76dc82c1b5a5a2b12f7ce0235c7e68476a26d28dc2dfa69a9ec9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c11b6eb5f9c76dc82c1b5a5a2b12f7ce0235c7e68476a26d28dc2dfa69a9ec9
SHA3-384 hash: e4165daef3a189bddb089ec24e4336a28908102f61c13c8c660505b4fe595b0c9890e0cb53677441acd9c44276e6eb02
SHA1 hash: ae4e64288edd6f99a3a7bacb1903983703ac00b3
MD5 hash: d88550a3d1e5bf5c2f6f2fc6a9b336f2
humanhash: echo-beer-mango-cold
File name:DHL_document11022020680908911.doc45.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:21'004 bytes
First seen:2021-03-25 07:24:06 UTC
Last seen:2021-03-29 08:20:34 UTC
File type: zip
MIME type:application/zip
ssdeep 384:ZbkhF/l+Bes+JnTzWdqicJ11rZtkFCeGmnyVrKTbQ:d6/0BelzWdqicJfZtwW
TLSH BE92B070C1115D0BC81D72FEB8A1FB19AACF53B5148A2F7D55CDE019C944EAACCD60AE
Reporter lowmal3
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
4
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_doc.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25512.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/1c11b6eb5f9c76dc82c1b5a5a2b12f7ce0235c7e68476a26d28dc2dfa69a9ec9
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c11b6eb5f9c76dc82c1b5a5a2b12f7ce0235c7e68476a26d28dc2dfa69a9ec9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-25 07:32:28 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dqi3n227tr3nzawbwws2fmjpptqcgxd6nbdwujwsrxbn7ju2t3eq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/1c11b6eb5f9c76dc82c1b5a5a2b12f7ce0235c7e68476a26d28dc2dfa69a9ec9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1c11b6eb5f9c76dc82c1b5a5a2b12f7ce0235c7e68476a26d28dc2dfa69a9ec9

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments