MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2673fbe0bb8384f65082a4ab3093b736a8a874e645ea20c56c02f9c76d5bc363. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2673fbe0bb8384f65082a4ab3093b736a8a874e645ea20c56c02f9c76d5bc363
SHA3-384 hash: b77b1c688ceac735a52ebedc10df52ae9f12bea9781016f0932de775b6043e2c2c30ab4358ad6db37867a60f3e59bd5c
SHA1 hash: 7cc73afb3377bea5185d3a8c62813c29dca47459
MD5 hash: cb2d993097f294e6fc2c7c5b3d50d001
humanhash: alpha-zulu-table-single
File name:PAYMENT ADVICE.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:490'496 bytes
First seen:2022-04-29 11:14:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:dz+knrEsPii3O+pPpNJOMQexeZpGAK39xb1Jj18UDTF:xvNiavJOMrxspGAEb1JBxDTF
TLSH T1E3A4236B85C0EF3AEABFC50FC8E43166A935547169AD1102B44520FE1F98CB643AED4E
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla payment zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""gulegul bybetiket"<gulegul@bybetiket.com>" (likely spoofed)
Received: "from bybetiket.com (unknown [185.222.57.240]) "
Date: "26 Apr 2022 06:36:12 +0200"
Subject: "Re: Advice for your payment"
Attachment: "PAYMENT ADVICE.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs812.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.W32.AIDetectNet.01.14180.7875.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/626bc8c72b32b1c37c71365c/reports/1bcdf113-141e-4c50-9c36-1971b582af09/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/2673fbe0bb8384f65082a4ab3093b736a8a874e645ea20c56c02f9c76d5bc363
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2673fbe0bb8384f65082a4ab3093b736a8a874e645ea20c56c02f9c76d5bc363/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-25 00:36:27 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
24 of 42 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ezz7xyf3qocpmuecusvtbe5xg2ukq5hgixvcbrlmal44o3k3ynrq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer suricata trojan
Link:
https://tria.ge/reports/220429-nckexsegbj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Drops file in Drivers directory
AgentTesla
suricata: ET MALWARE AgentTesla Exfil Via SMTP
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2673fbe0bb8384f65082a4ab3093b736a8a874e645ea20c56c02f9c76d5bc363

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2673fbe0bb8384f65082a4ab3093b736a8a874e645ea20c56c02f9c76d5bc363

(this sample)

AgentTesla

Executable exe bca80ec5a8f5f72b96fecabe891d7135d3a886cbf6582649d5466560b7381c47

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bca80ec5a8f5f72b96fecabe891d7135d3a886cbf6582649d5466560b7381c47
  
Dropping
AgentTesla

Comments