MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03fc6fb46457641645117a9c29292069714568ff711647455c70769d7ab3485a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03fc6fb46457641645117a9c29292069714568ff711647455c70769d7ab3485a
SHA3-384 hash: 2be921e621bca4adb34ee14f1e9261477f41189e0cd1b9095dbc2ba5502205fcb5e89a88ecd4aacb887faa5d691b149a
SHA1 hash: fb76eb813b4e072d68ffe2916a578d14cf845824
MD5 hash: f6aba9195644c0b69efff06ecf23e6c4
humanhash: ink-xray-single-burger
File name:Order Datasheet.scr
Download: download sample
Signature AgentTesla
Create hunting rule
File size:593'408 bytes
First seen:2020-06-10 18:51:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:KK5u5oao7fCFlfLsSNxYtSHbFBmf35BCslbvtDbGFG:KKY5oao7fCFpLsK4SHbsfCuvt
TLSH DEC4C04476D2AE4EC33E4E77452B28009BB095A77F27F3839CCB25DA149EF854640B9B
Reporter abuse_ch
Tags:AgentTesla scr


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.email-team.cf
Sending IP: 89.32.41.174
From: kim@sherline.com
Subject: KM20001-Order RFQ
Attachment: ORDER SPECIFICATION.IMG (contains "Order Datasheet.scr")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 18:53:06 UTC
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ap6g7ndek5sbmrirpkocskjanfyuk2h7oeleork4ob3j26vtjbna._file
Verdict:
malicious
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger rezer0 spyware stealer trojan
Link:
https://tria.ge/reports/201109-wxhrafdw52/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
rezer0
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img dee7ac8bf54ab79c50bdd1f92b0d4da3bdd61c637eeac771a849546f5bb3f721

AgentTesla

Executable exe 03fc6fb46457641645117a9c29292069714568ff711647455c70769d7ab3485a

(this sample)

  
Dropped by
MD5 554ea301983351b25b9874638d394990
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 dee7ac8bf54ab79c50bdd1f92b0d4da3bdd61c637eeac771a849546f5bb3f721

Comments