MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c41dda8208a35b5cd4cef1853906689c5a538911d6c3a919639516d55a96942. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8c41dda8208a35b5cd4cef1853906689c5a538911d6c3a919639516d55a96942
SHA3-384 hash: 2a20cceeb0b1268a8c7ecd276a0a77e40199eeea280341a2e2b3ee6c55c649434af4b992b31b7f73c85c96efd03b6ba7
SHA1 hash: e84127dc0513bf5dd573ca6187c392af216942bd
MD5 hash: a594272d78ca6cdc33fc236007bf9558
humanhash: montana-harry-beer-fillet
File name:Scan MT103_02152021.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:442'179 bytes
First seen:2021-02-15 11:32:13 UTC
Last seen:2021-02-15 16:40:25 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:W4tHKtMcz6IF3iobdqUwvaqLM/HSuKvWBtGaxnZh7rf:7ZKtLzh3iowVvjwivctHlZh7z
TLSH 939423D745841F588FB8339C433C6FBA209A4217E9E71EAEF7A2CD1395A606C4E1F584
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8c41dda8208a35b5cd4cef1853906689c5a538911d6c3a919639516d55a96942/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-14 20:36:30 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rra53kbari23ltkm54mfhedgrhc2koerdvwdvemwhfiw2vnjnfba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8c41dda8208a35b5cd4cef1853906689c5a538911d6c3a919639516d55a96942

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 8c41dda8208a35b5cd4cef1853906689c5a538911d6c3a919639516d55a96942

(this sample)

AgentTesla

Executable exe a96934da1f7a4fb130eb2d1d36af4c07de114c639c363b5249617e81e75422bb

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a96934da1f7a4fb130eb2d1d36af4c07de114c639c363b5249617e81e75422bb
  
Dropping
MD5 318fb2102f1ee9aee4a11ffa98c923b2

Comments