MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aba2bfde8e669b4458d3dff696cb921ebc9fa5ef8d3286e6bfa6095e23fa192f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aba2bfde8e669b4458d3dff696cb921ebc9fa5ef8d3286e6bfa6095e23fa192f
SHA3-384 hash: a4ab31723e1b0b49966531545cb181d4aa5ec1b0fd9a6bdafd35e80585ad7e913328da0c8bbae8ff8d7f4b8138975169
SHA1 hash: c83545abc19aa01469f5803c37da20e1e498ec02
MD5 hash: 25c9897678b75c928fe3d716704378e4
humanhash: hotel-kitten-queen-october
File name:Invoices & statement for PGI-KS.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:455'577 bytes
First seen:2021-03-05 13:01:40 UTC
Last seen:2021-03-10 01:02:40 UTC
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 12288:p1pdttCC2jtHQc3Bi+o+cvNYb0wPfKNrSSvjINhXT5:Jd+3pHQ4BVcduUrVL2hj5
TLSH 89A4235AF82EC215E4B79DF7502441A3530D0FA678CD0CAAEF22899732379A17E77613
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
7
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.26409.24253.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aba2bfde8e669b4458d3dff696cb921ebc9fa5ef8d3286e6bfa6095e23fa192f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-05 03:27:01 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vorl7xuom2nuiwgt373jns4sd26j7jppruzinzv7uyev4i72dexq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aba2bfde8e669b4458d3dff696cb921ebc9fa5ef8d3286e6bfa6095e23fa192f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z aba2bfde8e669b4458d3dff696cb921ebc9fa5ef8d3286e6bfa6095e23fa192f

(this sample)

AgentTesla

Executable exe 43e2d2c29a61f54e852de863249be0d070e4f71d8c77cbfd42d44beaf7ec8444

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 43e2d2c29a61f54e852de863249be0d070e4f71d8c77cbfd42d44beaf7ec8444
  
Dropping
MD5 c57a389805748823d46d9cc3bb3e52ac

Comments