MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 476de54b5de9af5f45faf864bd1a46802e58975f98e38c1624b30832a7695cd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 476de54b5de9af5f45faf864bd1a46802e58975f98e38c1624b30832a7695cd6
SHA3-384 hash: 8adaf1b724a676443bdccf2877ab6303e3c0f7a1a78bfa450ac90184795d8d16378dc95cdb37f4b4bcb20dc52e2c962f
SHA1 hash: fa6f5a46624d6289b13ce7fecc270c70e3f3509a
MD5 hash: a76bcb468f153b7c8352fad0995693dc
humanhash: saturn-fanta-hotel-utah
File name:RFQ pdf.tar.gz.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:542'720 bytes
First seen:2021-02-23 06:38:39 UTC
Last seen:2021-02-25 06:34:11 UTC
File type: gz
MIME type:application/x-tar
ssdeep 12288:vszdMMY06fVvkpv2axVQ+NsfUZhkdbduLJsDAE:OM8kWIax1hZ2b0LKZ
TLSH CAB4AE21229C9B0EE03EBB795114114F43F1A61AD727E68FBEE901DB7D56F408B32A17
Reporter cocaman
Tags:exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.27755.27967.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/476de54b5de9af5f45faf864bd1a46802e58975f98e38c1624b30832a7695cd6/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 06:39:11 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i5w6ks255gxv6rp27bsl2gsgqaxfrf27tdryyfrewmedfj3jltla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/476de54b5de9af5f45faf864bd1a46802e58975f98e38c1624b30832a7695cd6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ea14b2f05572c2086fbede5fde7c6b94b4f9a2d378680c656510f32bd1445e39

AgentTesla

gz 476de54b5de9af5f45faf864bd1a46802e58975f98e38c1624b30832a7695cd6

(this sample)

AgentTesla

Executable exe 80622d6bf536ca1e21f411864d3c4af7f4ebded98ea3aeeb6c99b964b247e3ca

  
Delivery method
Other
  
Dropped by
SHA256 ea14b2f05572c2086fbede5fde7c6b94b4f9a2d378680c656510f32bd1445e39
  
Dropping
SHA256 80622d6bf536ca1e21f411864d3c4af7f4ebded98ea3aeeb6c99b964b247e3ca
  
Dropping
MD5 0835d407446f230b2118ba9f5a0d76d0

Comments