MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48139682fd012c301a90b9dbf5599ff9a2fe5891ea82d5e128f6e52eafe75810. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48139682fd012c301a90b9dbf5599ff9a2fe5891ea82d5e128f6e52eafe75810
SHA3-384 hash: b8540ae400703f7182d4f10439f08fb664559f6beef9968f9eb0cca7c52070222f99fe0eda8a52e03135629e23cf2e22
SHA1 hash: 5a03b3c9ee6358dd75a5867384b44142908e5bc1
MD5 hash: 51a3218e4b288067d1291225a8aa8202
humanhash: pip-carpet-sixteen-beryllium
File name:Payment Transfer, order PO-1236-ES-MCB-DV.GZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:481'287 bytes
First seen:2021-04-08 07:27:04 UTC
Last seen:2021-04-08 14:38:48 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:4w6SMmYgM/eY7HEBArZmPyN/rE7bUaAJCHvW:47t2M/ek2ArZmPyhE7b/UCPW
TLSH E3A4233CB94D4518DED0F165E626C43A413131EFE5892AE5859EC383C7E38B87FA29C6
Reporter lowmal3
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
4
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/48139682fd012c301a90b9dbf5599ff9a2fe5891ea82d5e128f6e52eafe75810/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 07:28:05 UTC
File Type:
Binary (Archive)
Extracted files:
31
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jajznax5aewdaguqxhn7kwm77grp4wer5kbnlyji63ss5l7hlaia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/48139682fd012c301a90b9dbf5599ff9a2fe5891ea82d5e128f6e52eafe75810

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 48139682fd012c301a90b9dbf5599ff9a2fe5891ea82d5e128f6e52eafe75810

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments