MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a73be7051b0ada8252c9ab6aec9777a0cbcf477a5551051fca150b05d80d174. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a73be7051b0ada8252c9ab6aec9777a0cbcf477a5551051fca150b05d80d174
SHA3-384 hash: 0597b09ee15fe4f0e6d7baa656a2fe08888683aac4a2461ae5ccc9d5a592401fbf2c4cf7e628a09fb37cd26b0e161674
SHA1 hash: 0bc9853c966bde1897649f6b568ea4cc9373b514
MD5 hash: 325cbeb8e09f48d7017c553ad34c0712
humanhash: kitten-freddie-mango-sierra
File name:Purchase order PO1908514.LZH
Download: download sample
Signature AgentTesla
Create hunting rule
File size:669'685 bytes
First seen:2021-04-15 06:36:35 UTC
Last seen:2021-04-16 06:26:05 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:rRfSBIEWUtBcFHQN56yDn2Bm0C/KpxDh0hbaZasrTEMecgQwIEXgI:rxH/Fk56yDnkmHKLh0he3w7cgQN2X
TLSH 7CE42361F099431B7B725E08790288B0F18B3584F51736F6E2160E5FFFD8EBC26685A9
Reporter lowmal3
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
9
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2a73be7051b0ada8252c9ab6aec9777a0cbcf477a5551051fca150b05d80d174/
Threat name:
ByteCode-MSIL.Infostealer.Coins
Create hunting rule
Status:
Malicious
First seen:
2021-04-15 06:37:10 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fjz344crwcw2qjjmtk3k5slxpiglz5dxuvkraup4ufilaxma2f2a._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210415-ws2gkawe52/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
AgentTesla Payload
Looks for VirtualBox Guest Additions in registry
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2a73be7051b0ada8252c9ab6aec9777a0cbcf477a5551051fca150b05d80d174

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 2a73be7051b0ada8252c9ab6aec9777a0cbcf477a5551051fca150b05d80d174

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments