MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47c79e35921d9cb640a29cbb797fbf23a89bbd05be5dc7922cc11245a2515b2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47c79e35921d9cb640a29cbb797fbf23a89bbd05be5dc7922cc11245a2515b2f
SHA3-384 hash: 140046d9f74a3b1202d99f32a9ce04f9f1e43264a7e6f6111ffb72e58126405116186ea7898abc1c90890ddf3e9675dc
SHA1 hash: 43c61b6e37d4598f6b33fbda1f4aca1280d7c400
MD5 hash: d1f4aa51c45b0934e2bc37d4b0ad3f42
humanhash: missouri-hotel-eleven-eleven
File name:AOBO MOULD QUOTATION -1752002.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:400'899 bytes
First seen:2021-02-23 17:20:32 UTC
Last seen:2021-02-26 03:50:33 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:Fz+Te5dHPckpaMMymIEwh12UlGXhVjmHFGYN1CZcsq:FzQMdvHpaTyxJhYUlQVjmlzN1Kc7
TLSH 4D8423782232A3942BFFFFD69755A605E8205D908DA9DD887DBF8DE2B457020723EC05
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
4
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.ZTAtr.32716.15753.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47c79e35921d9cb640a29cbb797fbf23a89bbd05be5dc7922cc11245a2515b2f/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 11:44:48 UTC
AV detection:
4 of 47 (8.51%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i7dz4nmsdwolmqfcts5xs757eoujxpifxzo4permyejelisrlmxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/47c79e35921d9cb640a29cbb797fbf23a89bbd05be5dc7922cc11245a2515b2f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 47c79e35921d9cb640a29cbb797fbf23a89bbd05be5dc7922cc11245a2515b2f

(this sample)

AgentTesla

Executable exe 645aa084b296519c52ec4e4e2ba60c40b6d76399265cedf19e56d387b19523eb

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 645aa084b296519c52ec4e4e2ba60c40b6d76399265cedf19e56d387b19523eb
  
Dropping
MD5 b9403b7dbe5cf421de555eee9da84a68

Comments