MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5f0104b9b24aa09b19fa9c6c8f454c63f56bc7d36a0622114ff9b1aeb46683a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5f0104b9b24aa09b19fa9c6c8f454c63f56bc7d36a0622114ff9b1aeb46683a
SHA3-384 hash: ddebc1c9e8937a311ac9dcf847b5beee5c2a3cb41445702f04bd87c1af4160b076b3166c92e11252ffe91c5753d03714
SHA1 hash: 177d46774739acf6112021eb0f1ef64c85a0159c
MD5 hash: db1d34e3b29506449f4a58e3f2e7892d
humanhash: king-violet-louisiana-muppet
File name:orderpo.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:411'402 bytes
First seen:2021-02-04 12:04:23 UTC
Last seen:2021-02-04 16:06:35 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:IjYgUKOBPKI24oS+rOlHXnykVhiA8PsHTuY0k3KjEAK22pwF4IsujhiNSkFr6mQt:5pLR93TypdAKr2ru9nkQmQt
TLSH 28942389C54B27D2FB760F912CA8D24F72D20BC5AA826E41624D5D2CF81012D5FED6EF
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2008.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5f0104b9b24aa09b19fa9c6c8f454c63f56bc7d36a0622114ff9b1aeb46683a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-04 07:36:51 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yxybas43esvatmm7vhdmr5cuyy7vnpd5g2qgeiiu76nrv22gna5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c5f0104b9b24aa09b19fa9c6c8f454c63f56bc7d36a0622114ff9b1aeb46683a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c5f0104b9b24aa09b19fa9c6c8f454c63f56bc7d36a0622114ff9b1aeb46683a

(this sample)

AgentTesla

Executable exe 4680676a42011fbee774340878a3909c14e8875ec46142ffa4cd2f3f97e50671

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4680676a42011fbee774340878a3909c14e8875ec46142ffa4cd2f3f97e50671
  
Dropping
MD5 34d62fd9eb3d62f014fd05ea2491094d

Comments