MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e804f2914ce23f9c3ab3f5bc96799af2222c8f458d3e205369ea77deae2fbf53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e804f2914ce23f9c3ab3f5bc96799af2222c8f458d3e205369ea77deae2fbf53
SHA3-384 hash: 3eb5c82ce69f7c0ccc8432a03bfaf7c8117024c0b268fca355da702197685f2e70f3213d15badb9e76efdf51c70b5fc9
SHA1 hash: 8a44dc9d049116e74031e9896431e8fa469644dd
MD5 hash: be9a69defd22a8bd147eef0996aa50d2
humanhash: mango-five-alpha-five
File name:RFQ-272021.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:554'166 bytes
First seen:2020-11-26 07:06:34 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:wLt0ZNyLKxth+QMRU/Uek/FOUiT1t3sE/6un4YaaGOGuMX6sudCnfoe:wLq0LKxtxMRApEEUqxskr4YahjuMtudY
TLSH C6C423DCCAC72DE989F46FF1D7E694A4EAF81AF0854678781CF87DD766409A7C0012A0
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "info@nyheder.danskespil.dk" (likely spoofed)
Received: "from nyheder.danskespil.dk (unknown [45.147.229.20]) "
Date: "25 Nov 2020 18:22:11 -0800"
Subject: "Re: RFQ-272021"
Attachment: "RFQ-272021.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e804f2914ce23f9c3ab3f5bc96799af2222c8f458d3e205369ea77deae2fbf53/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-26 02:55:43 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5acpfekm4i7zyovt6w6jm6m26irczd2fru7cau3j5j355lrpx5jq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e804f2914ce23f9c3ab3f5bc96799af2222c8f458d3e205369ea77deae2fbf53

(this sample)

AgentTesla

Executable exe e13107c64261638ea91a7c3df4d1eec7153e1eab218b10fd027ddb0f52b95418

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e13107c64261638ea91a7c3df4d1eec7153e1eab218b10fd027ddb0f52b95418
  
Dropping
AgentTesla

Comments