MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3728057f7d9195c005a4268cc672c28661f29f956768a3929b74924c0be0433. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3728057f7d9195c005a4268cc672c28661f29f956768a3929b74924c0be0433
SHA3-384 hash: 65cccb5efeee0b4b3ab06e081d65456a3f3d5c6e610f732feadccaa6d16471a2f547039548c2d9cd4b7cb7a916fe8bb4
SHA1 hash: c2a8ba9162e75343d9a4e353d07856c300d3e5c5
MD5 hash: 93aa4834abd31a69b5047faaa0e7f74b
humanhash: butter-three-edward-robert
File name:file
Download: download sample
Signature AgentTesla
Create hunting rule
File size:641'939 bytes
First seen:2021-01-20 20:44:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:LWJXjRtJWOqJG0IPpZWUxsgoZjviD3Rnwv1KzQycaq+Ag+SioQI:LWVltJWOqJIiBZjvoy1UQyrYlo7
TLSH 8FD4239C187FD6A6C06829E75C76A4CA15905A78CC950507A6BD3B3C9D2E2BFCC3938C
Reporter fabjer
Tags:pdf

Intelligence

File Origin
# of uploads :
1
# of downloads :
227
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d3728057f7d9195c005a4268cc672c28661f29f956768a3929b74924c0be0433/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-20 20:17:57 UTC
AV detection:
17 of 45 (37.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2nziav7x3emvyac2ijumyzzmfbtb6kpzkz3iuojjw5esjqf6aqzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d3728057f7d9195c005a4268cc672c28661f29f956768a3929b74924c0be0433

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d3728057f7d9195c005a4268cc672c28661f29f956768a3929b74924c0be0433

(this sample)

AgentTesla

Executable exe 9ada932ad6919b4f21da2eb872e9af9ab1da22a818a13c57ae65b8679c6c7be1

  
Dropping
SHA256 9ada932ad6919b4f21da2eb872e9af9ab1da22a818a13c57ae65b8679c6c7be1
  
Delivery method
Distributed via e-mail attachment

Comments