MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29bf59fcb7749f2581317f2d3948cd246ed10ba50b5869be166f192acce699df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29bf59fcb7749f2581317f2d3948cd246ed10ba50b5869be166f192acce699df
SHA3-384 hash: c4c741b247621de56c06c62d66b2e663903359791a7b2b603fe5754c4c6b849ef802791943b2243f3a28e8427affe73a
SHA1 hash: ebbb2eec42a16d555d77f85c4ded128418fcf3b6
MD5 hash: 1ffdd08fe17fbcc5e7b86b2313097606
humanhash: florida-lion-muppet-chicken
File name:PO.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:662'899 bytes
First seen:2021-02-22 14:53:40 UTC
Last seen:2021-02-26 06:02:42 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:8Wiv5nZmkG4JBcF6/KnKQbpTQ2MdoGuf9xZJohrjMaL/THa36rd:8WunkkG4f//KnKQb5FMbwJEhvHZ
TLSH 24E423739B8D3D0FE2AA2CEAB6E5F2601D9B601A701387811CC9173B9797733315519B
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
8
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1137.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21241.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29bf59fcb7749f2581317f2d3948cd246ed10ba50b5869be166f192acce699df/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 14:54:05 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fg7vt7fxospslajrp4wtssgnerxncc5fbnmgtpqwn4msvthgthpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/29bf59fcb7749f2581317f2d3948cd246ed10ba50b5869be166f192acce699df

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 29bf59fcb7749f2581317f2d3948cd246ed10ba50b5869be166f192acce699df

(this sample)

AgentTesla

Executable exe cf239112a4bc5542b355e765ef8a5a139824fdeed307c3ff7821094d09577f1d

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cf239112a4bc5542b355e765ef8a5a139824fdeed307c3ff7821094d09577f1d
  
Dropping
MD5 45e8962b6756ba23fd82001695bcc628

Comments