MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf5fbcb67fe31d09acf27a5bfbd814046bdb05cb4ccee23e56f87833f8d90e66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf5fbcb67fe31d09acf27a5bfbd814046bdb05cb4ccee23e56f87833f8d90e66
SHA3-384 hash: 8b9b685c46dd1413eab20d447d024879802cf48c93f2803cf081243a4bfda5b0bedb9fe41924709ce5f05d0d4cfa8de7
SHA1 hash: dd03ad2a4a852e562a19beb03167996816537878
MD5 hash: 76a6ea422075b69cf5de1b851796faab
humanhash: batman-four-cardinal-paris
File name:file
Download: download sample
Signature AgentTesla
Create hunting rule
File size:455'027 bytes
First seen:2020-12-09 15:15:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Ae3LOC/C8tZnr+SxBN6EpaOnBBX7aZFEb2OYAYGgI5l6Fqw7pASfpa3n1a9c:x3tZnrXxBNtpLnBZ+Wk4lPUrl/hac6
TLSH A8A423C2A0DE25D48B3670FF11B59C9FE4132ED5201DD0EAFBE5E68256F7AB81C08684
Reporter fabjer
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2087.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf5fbcb67fe31d09acf27a5bfbd814046bdb05cb4ccee23e56f87833f8d90e66/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-09 15:16:06 UTC
AV detection:
17 of 46 (36.96%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z5p3znt74moqtlhspjn7xwauarv5wboljthoepsw7b4dh6gzbzta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cf5fbcb67fe31d09acf27a5bfbd814046bdb05cb4ccee23e56f87833f8d90e66

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip cf5fbcb67fe31d09acf27a5bfbd814046bdb05cb4ccee23e56f87833f8d90e66

(this sample)

AgentTesla

Executable exe fdfccd2b06ff7ace13bd64a1d1035f62dc5c81e303f0e96733680713b2b4294f

  
Dropping
SHA256 fdfccd2b06ff7ace13bd64a1d1035f62dc5c81e303f0e96733680713b2b4294f
  
Delivery method
Distributed via e-mail attachment

Comments