MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 411ce03275828c11e70ff5a393221295f20cce99eaea12d003242e389eab30bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 411ce03275828c11e70ff5a393221295f20cce99eaea12d003242e389eab30bc
SHA3-384 hash: afd2843189766de9511e49eb35b1a21e1322da766cce5807ba68bb84b1ba067fe68fcd5f6a9c81653698ece74f0e59ac
SHA1 hash: c4c657d9dada3eb0b7be83e5c42900872d9dd388
MD5 hash: 9dac62e020fcc7c8402a844805e32f19
humanhash: uncle-mexico-johnny-mexico
File name:411ce03275828c11e70ff5a393221295f20cce99eaea12d003242e389eab30bc
Download: download sample
Signature AgentTesla
Create hunting rule
File size:39'936 bytes
First seen:2020-07-07 06:46:19 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 768:R4lxtywXv1gMtg39yLtCOQAGw5DbOm2MNpewepX9zs3u2TaEs9:20wXv1g1EJCOQm5fOQpewepNzLEU
Threatray 132 similar samples on MalwareBazaar
TLSH 27038D1277579725E62D1937982E36480770F344AEB3EB2B3C5D312DDE227962B22F90
Reporter JAMESWT_WT
Tags:AgentTesla remcos

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/21868/
Result
Verdict:
Clean
Maliciousness:
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/411ce03275828c11e70ff5a393221295f20cce99eaea12d003242e389eab30bc/
Threat name:
ByteCode-MSIL.Trojan.Perseus
Create hunting rule
Status:
Suspicious
First seen:
2020-07-07 06:48:06 UTC
File Type:
PE (.Net Dll)
Extracted files:
3
AV detection:
5 of 29 (17.24%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1502cf57b3f170a9c0f179e8427085a953ea72e76fc0f654484d6e0e136c6f55
AgentTesla
1cde71bea7b12085fbe50e7f11afee55f7dcd6128b3f97a4d888436b19d4c2ea
AgentTesla
5548abe06d971143d889bb02d56403770e68907400349c8534ac99ecca193812
AgentTesla
733036ae8101048351d1cf684fe1bc02c1cf7a70725a470bec7cbd59a602738b
AgentTesla
82f9d45ee92a5f51af44dc11384e5a10fa12fbb46659291dc188a9222d17fc34
AgentTesla
a50f9170ee444aa88d99e2215f2ee8c1c7d1c9b93f686ec403e34ff16b585b86
AgentTesla
baadeb19ca78cd5bf6b02d15ffd5c90059b944415189ae24adca24abdc701b33
AgentTesla
c41873f177a61ec1e1cb628db96cddd70204b8a530e392bf210d7d4136be7375
AgentTesla
d71e012a83f40bf8ab9676453b7ad61b5b34ee748bcefd56693f073c5a453016
AgentTesla
f7289a6b1ebe784cb27873f8c8afb492d2ed9316b794f9aa13088d0a58c4c6db
AgentTesla
+ 122 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200707-fkslvznq76/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/pmelson/status/1280322293965688832?s=20
Cape
Cape
https://www.capesandbox.com/analysis/21868/

Comments