MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3f016e57d49ae1c93773293ba8da18fc4130cba5a3730b5ab9482f36be36022. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e3f016e57d49ae1c93773293ba8da18fc4130cba5a3730b5ab9482f36be36022
SHA3-384 hash: 661e7bf955012a961fcd62e8f95286481132bd4c96f285587e7cd948b0c3c71e6d393a9fccc7dee19a082fb3780f4b8e
SHA1 hash: d7f7fe9b31fb44da7d7e8fd00bc261fb8b18398a
MD5 hash: dceea81e422740107ee825092e21e628
humanhash: iowa-helium-michigan-mars
File name:PO 86540.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:671'514 bytes
First seen:2021-02-22 07:04:42 UTC
Last seen:2021-02-26 05:50:40 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:eg2PepzJZ9OAkurLADZhVvMDShOFeQMgQeJR1fLDrFjUvIrrYLYHsP+:FXzrFAVHwFeQMAR1fLX9QRcHa+
TLSH A6E433DE409A704ACBE6E15E7747F2802F8630B3FD0425899AE5CC94596BFECDD2148E
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
9
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23627.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e3f016e57d49ae1c93773293ba8da18fc4130cba5a3730b5ab9482f36be36022/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 07:05:07 UTC
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4pybnzl5jgxbze3xgkj3vdnbr7cbgdf2li3tbnnlssbpg27dmara._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e3f016e57d49ae1c93773293ba8da18fc4130cba5a3730b5ab9482f36be36022

(this sample)

AgentTesla

Executable exe 1d7afe081d6c3fab49219dbd714bc72cfc8f870d7afcfb85f0e51271bdb5d547

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1d7afe081d6c3fab49219dbd714bc72cfc8f870d7afcfb85f0e51271bdb5d547
  
Dropping
MD5 8d4e41a6b7ffa6a366088399b727da75

Comments