MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02186db1c17ea577ba1a0f03b9e69f4fb0cb41eeaa9ee11aa0d2979c0fa81c66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02186db1c17ea577ba1a0f03b9e69f4fb0cb41eeaa9ee11aa0d2979c0fa81c66
SHA3-384 hash: fcece230a05ee8cf90859a45b940d74c85f3b4a2f20020a43fb8f6e7662e1c680dc4db1aee413b16a1896f981ee38faa
SHA1 hash: feb30a0b4ad170bb4f56b168e32eb5b8c8abbdf2
MD5 hash: 2ffa76c6a24cfaa0ff1d4b8499b982e3
humanhash: papa-cat-bulldog-one
File name:Bank TT copy.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'169'408 bytes
First seen:2021-06-07 06:13:02 UTC
Last seen:2021-06-07 06:14:32 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:wSQxANUVYtXiZb7/KkNmX7mSE1JBZICIFX8xfIDRZ6ZjFBUDCDjQD:mIUYtXiZC4mrDY3mFX8uv6RFqI
TLSH 6845F1223345AB6AE53AA3751051400293F2FD4BE325D65E7EEDB2DF0A3AE414362773
Reporter cocaman
Tags:AgentTesla iso


Avatar
cocaman
Malicious email (T1566.001)
From: "Mazen Jaber <info@server-celebrate.xyz>" (likely spoofed)
Received: "from box.server-celebrate.xyz (box.server-celebrate.xyz [142.93.99.134]) "
Date: "Mon, 07 Jun 2021 03:38:07 +0100"
Subject: "Urgent!!! Our Payment (39.750,00 USD)"
Attachment: "Bank TT copy.iso"

Intelligence

File Origin
# of uploads :
2
# of downloads :
169
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.LyWgkx-2
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02186db1c17ea577ba1a0f03b9e69f4fb0cb41eeaa9ee11aa0d2979c0fa81c66/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-06-06 22:40:31 UTC
File Type:
Binary (Archive)
Extracted files:
103
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aimg3mobp2sxpoq2b4b3tzu7j6ymwqpovkpocgva2klzyd5idrta._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210607-6axt62dcas/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/02186db1c17ea577ba1a0f03b9e69f4fb0cb41eeaa9ee11aa0d2979c0fa81c66

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 02186db1c17ea577ba1a0f03b9e69f4fb0cb41eeaa9ee11aa0d2979c0fa81c66

(this sample)

AgentTesla

Executable exe e709be2a43cf2eac1c6bdfabb2127e8ac9f5bc9f95985d86822cced1f19a8420

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e709be2a43cf2eac1c6bdfabb2127e8ac9f5bc9f95985d86822cced1f19a8420

Comments