MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c81ac1de374eece410515eab3c2c94c0b83c6589f2bbc925fdeac400ad1fae89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c81ac1de374eece410515eab3c2c94c0b83c6589f2bbc925fdeac400ad1fae89
SHA3-384 hash: 2fed66568b864e18269a167faff6eda2ecabbe4004b8c4392d905017fe12df0c59980b2e2ae463b6dcf0d5520dcfa54a
SHA1 hash: 1f5619c94e6147f9552e0ee12e453196902df74e
MD5 hash: 98a08b5e3404efd46b446e6289755506
humanhash: romeo-virginia-sodium-fish
File name:Revised PO 22022021,pdf.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:656'616 bytes
First seen:2021-02-22 07:40:19 UTC
Last seen:2021-02-26 18:33:42 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:SEP60iYgCWgjVhf9OAkurLjcDiDW2bZaH2cgOLeMO9eWTmU/R6sWPzJ:SEP60i2VhlrFjcDiDWi+gONO9eWZmPzJ
TLSH 2ED4234ECFEA7C074AB9EF451C5227FF7381FA6D61F247824A795244B1B2A066113B38
Reporter cocaman
Tags:AgentTesla r00


Avatar
cocaman
Malicious email (T1566.001)
From: "Salem AL-ATTAS <fomin@sencao.casa>" (likely spoofed)
Received: "from jgg0.sencao.casa (jgg0.sencao.casa [195.58.38.60]) "
Date: "21 Feb 2021 23:07:29 -0800"
Subject: "order for Leylaty group leylaty-RAK-22.02.2021"
Attachment: "Revised PO 22022021,pdf.r00"

Intelligence

File Origin
# of uploads :
11
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_badexts46.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.26176.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c81ac1de374eece410515eab3c2c94c0b83c6589f2bbc925fdeac400ad1fae89/
Threat name:
ByteCode-MSIL.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 07:41:12 UTC
File Type:
Binary (Archive)
Extracted files:
68
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zanmdxrxj3woiecrl2vtyleuyc4dyzmj6k54sjp55lcabli7v2eq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c81ac1de374eece410515eab3c2c94c0b83c6589f2bbc925fdeac400ad1fae89

(this sample)

AgentTesla

Executable exe 1efe450ba1d956b2633028670b5c62dea1cc8b8f976a9a951273fc09c798203a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1efe450ba1d956b2633028670b5c62dea1cc8b8f976a9a951273fc09c798203a
  
Dropping
AgentTesla

Comments