MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2151588f65d2c67edef42954eab24f6812012fd88b8cf155e12c4b991c4a3fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2151588f65d2c67edef42954eab24f6812012fd88b8cf155e12c4b991c4a3fc
SHA3-384 hash: 3c71cadf5d08f5e51e0037ea3fa31e233975807b434bdf6a0adddbe645f3724146325bd5fc5f76b474deb5cd8eb7b6ff
SHA1 hash: 1c58120f2c27e993ebbbad9cabd618d0e093d287
MD5 hash: 3c9770f3a4da1ff3bc43e9d883332441
humanhash: nevada-twelve-one-eight
File name:Purchase order PO1908516.LZH
Download: download sample
Signature AgentTesla
Create hunting rule
File size:483'476 bytes
First seen:2021-04-13 09:24:07 UTC
Last seen:2021-04-14 06:17:56 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:QvZZHZvvJQXgGkGa2Jxe3ohLlUuWdh+4UgpNywYBLYuBs8emhd:QvZhZxQXgXqceLl0Mx2QXBfBsUhd
TLSH 52A423611E49DDF15C120EAE804FE8542948EC01C582CB9D0BE64DBE5EAF998FC15EBF
Reporter lowmal3
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
5
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2151588f65d2c67edef42954eab24f6812012fd88b8cf155e12c4b991c4a3fc/
Threat name:
Win32.Backdoor.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-04-13 09:25:05 UTC
AV detection:
2 of 47 (4.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ikrlchwluwgp3ppikku5kze62asaex5rc4m6fk6clclteoeup6a._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210413-s4f3r3lmqa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/f2151588f65d2c67edef42954eab24f6812012fd88b8cf155e12c4b991c4a3fc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f2151588f65d2c67edef42954eab24f6812012fd88b8cf155e12c4b991c4a3fc

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments