MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2efe4d65e4d99d90838e95b0033b3adb548ab9f75cf04448583d1df084d57f9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2efe4d65e4d99d90838e95b0033b3adb548ab9f75cf04448583d1df084d57f9e
SHA3-384 hash: bd553be9bd304d933bc6098607f00345ae800843f0aa1b69d0df26d79b82d519aede155cbaff3729866e680804dd8c3f
SHA1 hash: 9a061cd7999013a455ae645ffe682333481936b1
MD5 hash: 51afb632c66888acc8f7dbdf8f9e8835
humanhash: six-washington-december-east
File name:Delivery Details pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:3'194'880 bytes
First seen:2021-03-22 07:40:00 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 49152:0WqPOv/gxcBbzU6ve6CecVc+7shTVVgIKr8VRSPkbJ:AP4/gxcBbzU6vs6VgIKr8VRSPkb
TLSH CFE51A027F40EE54E01A2937C1DB801C87E9AE5127B2E32F78D93BED55217A76C0E9D9
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: xrns.filezz.uno
Sending IP: 85.204.116.151
From: Shipping <sales@filezz.uno>
Subject: SHIPMENT DETAILS- 64868
Attachment: Delivery Details pdf.img (contains "Delivery Details pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts66.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2efe4d65e4d99d90838e95b0033b3adb548ab9f75cf04448583d1df084d57f9e/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-22 07:40:13 UTC
AV detection:
5 of 47 (10.64%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f37e2zpe3gozba4oswyagoz23nkivopxltyeiscyhuo7bbgvp6pa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/2efe4d65e4d99d90838e95b0033b3adb548ab9f75cf04448583d1df084d57f9e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 2efe4d65e4d99d90838e95b0033b3adb548ab9f75cf04448583d1df084d57f9e

(this sample)

AgentTesla

Executable exe 916df1aaac228a40f1981b539742aee6d0009fdce746f14eb646a7c70fa2cc4d

  
Dropping
MD5 a1a6034aded04b2867bfbf60a493b3cb
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 916df1aaac228a40f1981b539742aee6d0009fdce746f14eb646a7c70fa2cc4d

Comments