MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad36807d445ada08151fc65a3588b7c3b963d3fb0795142c52e3abdcfe11b992. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad36807d445ada08151fc65a3588b7c3b963d3fb0795142c52e3abdcfe11b992
SHA3-384 hash: 9391c9ac1b7eb8e7df6445f287a6222b593284aaf64c4ac72e50f361d94a38ed31d2a9678973af53df210b2412bd7ba0
SHA1 hash: 119d46e8b52f5795963226da11c5293275ac5b40
MD5 hash: 3a69745cf008030bfb7f44d49533d962
humanhash: oxygen-hotel-hamper-alanine
File name:TT-SWIFT COPY.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:833'667 bytes
First seen:2021-02-19 09:40:39 UTC
Last seen:2021-02-19 20:34:40 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:/f1zDnO6tX5UF4AMw4ItPK12CLlgToOCO1OJDW0eBRwnauCaphUIYHmPRcO3n8O4:cCX53wBJCBgZCOO/CchUZGB3ne3
TLSH C20533DAE37AB1DE4712A08126CD65D065D1C6E61B273248E394ABE41D48CCCFC4EE2F
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn112.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad36807d445ada08151fc65a3588b7c3b963d3fb0795142c52e3abdcfe11b992/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-19 01:53:39 UTC
AV detection:
17 of 46 (36.96%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vu3ia7kellnaqfi7yzndlcfxyo4whu73a6krilcs4ov5z7qrxgja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ad36807d445ada08151fc65a3588b7c3b963d3fb0795142c52e3abdcfe11b992

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ad36807d445ada08151fc65a3588b7c3b963d3fb0795142c52e3abdcfe11b992

(this sample)

AgentTesla

Executable exe 744a76c70e3ac09347eec24b97511a50c8574ae1b6cda1634ece4adae03581d5

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 744a76c70e3ac09347eec24b97511a50c8574ae1b6cda1634ece4adae03581d5
  
Dropping
MD5 bf56b6516631efb6835bc1c4ae9f1094

Comments