MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0944a853b75533a9461ca78df2ed3166eaa8b37ec98b4159c33dbaf375ee431f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0944a853b75533a9461ca78df2ed3166eaa8b37ec98b4159c33dbaf375ee431f
SHA3-384 hash: d1fcd068bc362cc43c34c658ee14e9d85ed47e83db474afeb8f31ef02f1d6898ada3509feedcabc9f9ff577577d6531d
SHA1 hash: 47bae8a218358aaa2a01431f75b073f9d81be1ed
MD5 hash: 647c6f3eebf5253b5cc8fe71d5d313d3
humanhash: solar-east-stream-kentucky
File name:Scan 0730.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:577'406 bytes
First seen:2021-05-10 05:35:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:NMULerPufUv0PQnooAB2aKBS72fNj3gdQ99QCNF8DN8aTYX/:aGfUvwoABvKY2fNjQQlCvYP
TLSH 14C42375283B26DD0F761AF13D0475F18449D07336A9D82AE2FF18B1DCABA46C59B0B2
Reporter cocaman
Tags:AgentTesla SWIFT zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Archana THAMBI <eric@itri.org.tw>" (likely spoofed)
Received: "from itri.org.tw (unknown [103.133.106.100]) "
Date: "9 May 2021 20:15:50 -0700"
Subject: "Swifts"
Attachment: "Scan 0730.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.16663.25123.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/0944a853b75533a9461ca78df2ed3166eaa8b37ec98b4159c33dbaf375ee431f
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0944a853b75533a9461ca78df2ed3166eaa8b37ec98b4159c33dbaf375ee431f/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-05-10 05:36:13 UTC
File Type:
Binary (Archive)
Extracted files:
103
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bfckqu5xkuz2srq4u6g7f3jrm3vkrm36zgfucwodhw5pg5poimpq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210510-at5dymc7za/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0944a853b75533a9461ca78df2ed3166eaa8b37ec98b4159c33dbaf375ee431f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0944a853b75533a9461ca78df2ed3166eaa8b37ec98b4159c33dbaf375ee431f

(this sample)

AgentTesla

Executable exe a58b212d35c518bce8ada5a1952613e9028aee9ff5483515dc8c54a60908174e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a58b212d35c518bce8ada5a1952613e9028aee9ff5483515dc8c54a60908174e
  
Dropping
AgentTesla

Comments