MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 512dad9f0d672b5f245666b860d764a1f679442f9a615ad9555a37f6fb91988f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 512dad9f0d672b5f245666b860d764a1f679442f9a615ad9555a37f6fb91988f
SHA3-384 hash: ad6b634e5c5dd60c61be44d340da3c4e96ec5e1f6bf1370c13f0aa2760066c2e5caf8bb1a149f9aade8e328e9cbea17e
SHA1 hash: 1774837ebb105741ee5dbb56df43703a1be0540e
MD5 hash: 31edd03c07d4d57a2d38225e4413d080
humanhash: friend-thirteen-nineteen-princess
File name:Additional documents required.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:535'551 bytes
First seen:2021-02-26 02:04:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:W44z5c3qQZtTvCx6tNFSUBVxJ38sNZkQZ22YOc8Sw/cf:54za39TvCwTBzB5yDXMS
TLSH 18B42399B2E860C2C36E058547C498A09EED07FA0AD2FF75D11710EA9C6BC5FBC495CE
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_Wordexe.1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/512dad9f0d672b5f245666b860d764a1f679442f9a615ad9555a37f6fb91988f/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-25 18:19:00 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kew23hynm4vv6jcwm24gbv3euh3hsrbptjqvvwkvli37n64rtchq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 512dad9f0d672b5f245666b860d764a1f679442f9a615ad9555a37f6fb91988f

(this sample)

AgentTesla

Executable exe e6b59da10843082defd8db8473dee80acec1d15d1180e544ff0b244c3fe19db7

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e6b59da10843082defd8db8473dee80acec1d15d1180e544ff0b244c3fe19db7
  
Dropping
MD5 920854d30aada9761924b014f1c8bcc7

Comments