MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e528bc13b83f49c42230bd4c2f4279c187c0bab57b872e9ca152b52a395c316e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e528bc13b83f49c42230bd4c2f4279c187c0bab57b872e9ca152b52a395c316e
SHA3-384 hash: aed1f31535d575ae7de2cea750f94e44089e89ce0140825d3534580481e04b90a0f86d4e2cd4ca6d12a6d71f06fc7197
SHA1 hash: f77f4275268fc3117e7a7b638d3e2c5804ddab4b
MD5 hash: dab916e4d0746060c601dc67f518c1cd
humanhash: item-early-apart-green
File name:Additional documents.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:704'763 bytes
First seen:2021-02-16 23:28:42 UTC
Last seen:2021-02-17 17:59:42 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:p38MyQB3qyyvP8fhBGA5Oya/DiyA6GkW6CH0HyrQHv3iXL13Q/C8YlO5nERtI:zB3qTP8fJtuRYP64lru3iXLhQ/7nEc
TLSH 67E423185C4A2BDF5074EA60E9A57B0803CD196E38D32E81FE7B92EE55F1473E21099F
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42845.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e528bc13b83f49c42230bd4c2f4279c187c0bab57b872e9ca152b52a395c316e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-16 12:37:29 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4uulye5yh5e4iirqxvgc6qtzygd4bovvpods5hfbkk2suok4gfxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/e528bc13b83f49c42230bd4c2f4279c187c0bab57b872e9ca152b52a395c316e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e528bc13b83f49c42230bd4c2f4279c187c0bab57b872e9ca152b52a395c316e

(this sample)

AgentTesla

Executable exe c2ae8f03a4c70c1a976ab882238a8df26aebc713cd28e1896f883ea9da1f76de

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c2ae8f03a4c70c1a976ab882238a8df26aebc713cd28e1896f883ea9da1f76de
  
Dropping
MD5 9ce7dbaa399c553d3fbeae037b810085

Comments