MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 decf59b9942d9473c45fd108432a13fc2dd38397efc0a178dc6981a4179fc887. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: decf59b9942d9473c45fd108432a13fc2dd38397efc0a178dc6981a4179fc887
SHA3-384 hash: 6885ecfff1bfa29ecbff8beaeebed0994442b16d872ab18300f24f0509365ea954d6867c55492bfcfa557e6cee587d1f
SHA1 hash: 9e6c5f829af0fed110d38395de3e0c9d6b56281e
MD5 hash: 0b59d792f6b919c734f898ddbfbae79d
humanhash: pip-shade-burger-grey
File name:SWIFT.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:757'359 bytes
First seen:2021-01-21 08:45:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:KqOZOtr5R4/Wauq4XQYIvMTkVLRPNmkQZV1HYbn9e6uI/oaPmXByP2o:y0tNeWOXvMTIFlmVb9+9eduPmX8
TLSH C5F433175475A145C822E9F3998BD25808305E7357BF6B063A86F0ECBCB4EC36EB1A1C
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/decf59b9942d9473c45fd108432a13fc2dd38397efc0a178dc6981a4179fc887/
Threat name:
ByteCode-MSIL.Packed.Confuser
Create hunting rule
Status:
Malicious
First seen:
2021-01-21 08:45:10 UTC
AV detection:
21 of 46 (45.65%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=33hvtomufwkhhrc72eeegkqt7qw5ha4x57akc6g4nga2if47zcdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/decf59b9942d9473c45fd108432a13fc2dd38397efc0a178dc6981a4179fc887

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip decf59b9942d9473c45fd108432a13fc2dd38397efc0a178dc6981a4179fc887

(this sample)

AgentTesla

Executable exe a14532851a6cf9501f2a4f5b0ecc61d4ef8e10d220a401b220cd06ae8f83aeee

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a14532851a6cf9501f2a4f5b0ecc61d4ef8e10d220a401b220cd06ae8f83aeee
  
Dropping
MD5 e1c2dfde03ce13e517b7b25f4ef39fce

Comments