MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 893f48d50192ac7af60789abaa30a15a84a531f2aa33d6320ddf606ae6eeb24f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 893f48d50192ac7af60789abaa30a15a84a531f2aa33d6320ddf606ae6eeb24f
SHA3-384 hash: 14db516cdbf2f68caa0749fb550b358957dd38e9fec4f7b8711bc364f4f5812f6052dc586a9c0da9aa025c0689b079b2
SHA1 hash: 1cca553ca1402167157fbd462a016e103803a094
MD5 hash: 4fea503af384f9e3c18b7d06a2218c42
humanhash: jupiter-potato-november-crazy
File name:WireTransfer Copy767.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:396'996 bytes
First seen:2020-11-18 23:43:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Ke31T4768uGync+8xuBdw5fZH7+5qxkZQ3gq00PGZs5XtQfeXMl6jufGpHh5QZ:KecXnbH78RZv7gtQfe8l6jUwc
TLSH F0842371F64D88CEAFDFE6A9765A022005D1283E1527215E138AE10AFFD9FF8933905D
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_Copynum.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/893f48d50192ac7af60789abaa30a15a84a531f2aa33d6320ddf606ae6eeb24f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 23:44:05 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=re7urvibskwhv5qhrgv2umfblkckkmpsviz5mmqn35qgvzxowjhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 893f48d50192ac7af60789abaa30a15a84a531f2aa33d6320ddf606ae6eeb24f

(this sample)

AgentTesla

Executable exe ff30ebf52489bc096912d3d89259f8f6e44ec3ced1d124094d10f2fbfaa18590

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ff30ebf52489bc096912d3d89259f8f6e44ec3ced1d124094d10f2fbfaa18590
  
Dropping
MD5 abd4f8ae27c14959d826406b5593fc21

Comments