MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e81c350e4cbb90f9fa5fa0dfc17e9ac35bc17cd3413f352246f9bef79c460dea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e81c350e4cbb90f9fa5fa0dfc17e9ac35bc17cd3413f352246f9bef79c460dea
SHA3-384 hash: f22772a5a9a32683088f961ddc69f02654fafad2abe00e68b8ff19f7d6bd05e1c54a363f4ecc54f23f38dc7ef66b24d2
SHA1 hash: 079b22d583a322229986f5003ba46d3d977446a6
MD5 hash: 3b7147001feec0e871bdcd78b0fca7f8
humanhash: fruit-eighteen-helium-snake
File name:Samples_#9330748 TUNG YUNG INTERNATIONAL LIMITED.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:610'730 bytes
First seen:2021-02-09 06:47:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:7/1QqbrrzdeR0A8MMTpIowuzXASITWy2oTlqV7qEFKuQ0EN/VYlR:7/Gq/y00M6SIKy2V7q0NEbiR
TLSH 62D4232C7134543153B3BE1BA47384F2C1F45A703096F7DD68E695925E885832BFB8B8
Reporter GovCERT_CH

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.533.1012.3522.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e81c350e4cbb90f9fa5fa0dfc17e9ac35bc17cd3413f352246f9bef79c460dea/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-08 01:55:52 UTC
AV detection:
3 of 47 (6.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5aodkdsmxoipt6s7udp4c7u2ynn4c7gtie7tkisg7g7pphcgbxva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e81c350e4cbb90f9fa5fa0dfc17e9ac35bc17cd3413f352246f9bef79c460dea

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e81c350e4cbb90f9fa5fa0dfc17e9ac35bc17cd3413f352246f9bef79c460dea

(this sample)

AgentTesla

Executable exe 149ebb356a2e08ec3894093087e9cd746eab8ac26577beb15a0275c8e0c13493

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 149ebb356a2e08ec3894093087e9cd746eab8ac26577beb15a0275c8e0c13493
  
Dropping
MD5 ea2ec507c0b136f4bad3d38fc0e4aefa

Comments