MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 034f770796527674a91815023e4bf24699a8ca31efe6a2349188af32e6e67060. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 034f770796527674a91815023e4bf24699a8ca31efe6a2349188af32e6e67060
SHA3-384 hash: 96577d2fc7edde381ead16a4a10a40f9cef8007fff4fba63a8972c71360026612ccabdc8c387ee686eacb79249ac455c
SHA1 hash: 3cfbf87b36399e4814d233d4e6e2b792b592529d
MD5 hash: e606dc50102a6aab21586c81682b5c2d
humanhash: wyoming-island-golf-mountain
File name:Bank TT Copy.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:940'032 bytes
First seen:2021-06-08 05:42:54 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:loUVYtXiZuDgqukxC8JOSEHRlWyPF/GvLe5:uUYtXiZigq88MSEDW4pGvL
TLSH FE15F16127249B93D3688A700862F2780AF67D666EA0E74F3D9C31DC7BB7F194E11712
Reporter cocaman
Tags:AgentTesla iso


Avatar
cocaman
Malicious email (T1566.001)
From: "Mazen Jaber <info@server-celebrate.xyz>" (likely spoofed)
Received: "from box.server-celebrate.xyz (box.server-celebrate.xyz [142.93.99.134]) "
Date: "Tue, 08 Jun 2021 05:29:02 +0100"
Subject: "Urgent!!! Our Payment (39.750,00 USD)"
Attachment: "Bank TT Copy.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.6047.20948.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/034f770796527674a91815023e4bf24699a8ca31efe6a2349188af32e6e67060/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-08 05:43:12 UTC
File Type:
Binary (Archive)
Extracted files:
66
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=anhxob4wkj3hjkiycubd4s7si2m2rsrr57tkenerrcxtfzxgobqa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210608-s6bfa6pkzs/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/034f770796527674a91815023e4bf24699a8ca31efe6a2349188af32e6e67060

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 034f770796527674a91815023e4bf24699a8ca31efe6a2349188af32e6e67060

(this sample)

AgentTesla

Executable exe c786e0379beca0fae70411e47c89af47389b3469ec8d5c8d8c399f1b5d78a856

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c786e0379beca0fae70411e47c89af47389b3469ec8d5c8d8c399f1b5d78a856

Comments