MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 16f7ed92a89c49bd047aae5d809978a6d55f1344ca39dfe4a6444cab091d48ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 10
| SHA256 hash: | 16f7ed92a89c49bd047aae5d809978a6d55f1344ca39dfe4a6444cab091d48ef |
|---|---|
| SHA3-384 hash: | 21824082879744cb746f650aa02ff01c955b5c4749b45b221c77fddd3945c031196363a37e051ad3f56f824533b83df2 |
| SHA1 hash: | 8778e37fe4459dd66e944f7574ac1fd5722c2190 |
| MD5 hash: | 515f80901126cf39a1a88097c2d542cb |
| humanhash: | hot-florida-beryllium-queen |
| File name: | Veyhl new order - PO 351081.7z |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 646'132 bytes |
| First seen: | 2024-09-09 14:43:28 UTC |
| Last seen: | Never |
| File type: | 7z |
| MIME type: | application/x-7z-compressed |
| ssdeep | 12288:ym6sUS1lQWYvaKXbGiQie8a8VFIZN6WryIuNfQSZmoS8RXoXM:ymlxi3QixdFIZNA3ZPFRoXM |
| TLSH | T1E1D4232B99F3542544C234D7E8259F28B42D1697F79BD0A9A40603977CE2F9AC8FCE31 |
| TrID | 57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1) |
| Magika | sevenzip |
| Reporter |  cocaman |
| Tags: | 7z AgentTesla |
cocaman
Malicious email (T1566.001)From: "Laura Winkelmann [Veyhl GmbH] <laura.winkelmann@veyhl.com>" (likely spoofed)
Received: "from veyhl.com (216-131-73-250.iad.as62651.net [216.131.73.250]) "
Date: "09 Sep 2024 07:42:14 -0700"
Subject: "new order - PO 351081"
Attachment: "Veyhl new order - PO 351081.7z"
Intelligence
File Origin
# of uploads :
1
# of downloads :
426
Origin country :
CHFile Archive Information
This file archive contains 1 file(s), sorted by their relevance:
| File name: | Veyhl new order - PO 351081.exe |
|---|---|
| File size: | 879'616 bytes |
| SHA256 hash: | 8ccca04fe86f770d8057a7209a6d31da8df7bace6f4a3d8e04d5bbfefc2661f3 |
| MD5 hash: | 61136861ddae7d53a0165c710bab05fe |
| MIME type: | application/x-dosexec |
| Signature | AgentTesla |
Vendor Threat Intelligence
Detection(s):
Verdict:
Malicious
Score:
99.9%
Tags:
Banker Encryption Execution Generic Network Static Heur Dexter
Result
Verdict:
Unknown
File Type:
PE File
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
masquerade overlay packed
Verdict:
Suspicious
Labled as:
Mal/Drod7zip
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Threat name:
Win32.Spyware.Negasteal
Status:
Malicious
First seen:
2024-09-09 10:55:42 UTC
File Type:
Binary (Archive)
Extracted files:
41
AV detection:
19 of 24 (79.17%)
Threat level:
2/5
Detection(s):
Suspicious file
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla credential_access discovery execution keylogger spyware stealer trojan
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Credentials from Password Stores: Credentials from Web Browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
AgentTesla
7z 16f7ed92a89c49bd047aae5d809978a6d55f1344ca39dfe4a6444cab091d48ef
(this sample)
exe Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.