MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 151d40f96e19eac14aad67e13cb5ba637633b3f4186080b199db33db9a375504. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 151d40f96e19eac14aad67e13cb5ba637633b3f4186080b199db33db9a375504
SHA3-384 hash: 3ee867c05719f55eb7ffb17ad032ff5312d427407b6e2bcbd2aa48d9ea0a2589ea6b13258183d9027419202f91060d26
SHA1 hash: 5565a59c20e4aed8015155b859236d899676938f
MD5 hash: ee221f7def0b10e34b7b585128fc2bd1
humanhash: victor-delaware-football-green
File name:Request for Quotation (4).zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:891'315 bytes
First seen:2022-04-14 06:14:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:YZ8nw5JfYcuZvjxG9eXtZJ4C5kVPDtAO2+GxK33:Y6nw5JfYcupxG9ed4FMjxU3
TLSH T1A91533A4834B7D6F40F7B4F96C5FC5780C62813B38905745E69253A6DDDEB83C90B8A8
Reporter cocaman
Tags:AgentTesla QUOTATION zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""Japan Marine-Team C"<salesfive@jmsgroup.jp>" (likely spoofed)
Received: "from jmsgroup.jp (unknown [185.222.57.181]) "
Date: "13 Apr 2022 07:21:54 +0200"
Subject: "Request for Quotation of our Inquiry No. TIM-037/2022e-I003"
Attachment: "Request for Quotation (4).zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
261
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs289.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Artemis2E3F37E38A3E.17859.9813.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6257bbea482f2f41caac1ae0/reports/3820e9cf-e063-4fe4-9805-d1eb0b1c90a1/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/151d40f96e19eac14aad67e13cb5ba637633b3f4186080b199db33db9a375504
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/151d40f96e19eac14aad67e13cb5ba637633b3f4186080b199db33db9a375504/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-12 08:39:13 UTC
File Type:
Binary (Archive)
Extracted files:
81
AV detection:
25 of 42 (59.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cuoub6lodhvmcsvnm7qtznn2mn3dhm7udbqibmmz3mz5xgrxkuca._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220414-gzxkfahdcn/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5167639867:AAFp5rpwhccJwSR0NNRceLhFKcs218dT21U/sendDocument
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/151d40f96e19eac14aad67e13cb5ba637633b3f4186080b199db33db9a375504

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 151d40f96e19eac14aad67e13cb5ba637633b3f4186080b199db33db9a375504

(this sample)

AgentTesla

Executable exe f965c51825b3de818f81dd4c5f4b93c6e5d0a8b035e02be55a070013c1f24519

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f965c51825b3de818f81dd4c5f4b93c6e5d0a8b035e02be55a070013c1f24519
  
Dropping
AgentTesla

Comments