MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b94576fd11ef2c01df19e1170274e70e5c63dc307959b6470a94df6d5b8d823. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b94576fd11ef2c01df19e1170274e70e5c63dc307959b6470a94df6d5b8d823
SHA3-384 hash: 35c6baae6ede224722adcabcb3b36ea08ab766a2e5c5b0029c25aace215095b3e7ea41f3e986ca1d6fdf77a0bce8ea56
SHA1 hash: d955bf366cbd1a8115c44782e33591930ebacaa5
MD5 hash: 459a79b6583f9c4cfc2fc3d5df6f7988
humanhash: lion-artist-pizza-white
File name:IFE Gmbh,and Engineering Request for Quotation (RFQ).rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'765 bytes
First seen:2023-07-07 07:00:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 48:2irC15Lrwvvyi/Fwa7Xu08G+tPMwxhJ75ShXmwgK2UNHZqu/OLtSIH:jGPkHx1L78G+tPMej75S8wP2equmLd
TLSH T125516E9434090D5D2169B1FB6FF5E835018C54DA61421E734B0DC4DC96B49DAE73CBC4
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:AgentTesla QUOTATION rar RFQ


Avatar
cocaman
Malicious email (T1566.001)
From: ""Martha-IFE Gmbh" <mohamed.shokry@enppi.com>" (likely spoofed)
Received: "from donald.totcrist.info (donald.totcrist.info [88.209.205.212]) "
Date: "6 Jul 2023 11:46:48 +0200"
Subject: "IFE Gmbh,and Engineering Request for Quotation (RFQ)"
Attachment: "IFE Gmbh,and Engineering Request for Quotation (RFQ).rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:IFE Gmbh,and Engineering Request for Quotation (RFQ).vbs
File size:326'730 bytes
SHA256 hash: bdc3b394b6fa647e13f3b728786c14a58e44af9f174563550a7bab578303d1c8
MD5 hash: 9024ed9423885c42335a151dfcefc576
MIME type:text/plain
Signature AgentTesla
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
lolbin replace
Link:
https://www.filescan.io/uploads/64a7b82f7e0af7bfbe3356c1/reports/8955735d-38f4-4494-989d-fe0c375a1ce8/overview
Verdict:
Malicious
Labled as:
Trojan.GenericS
Link:
https://www.hybrid-analysis.com/sample/2b94576fd11ef2c01df19e1170274e70e5c63dc307959b6470a94df6d5b8d823
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b94576fd11ef2c01df19e1170274e70e5c63dc307959b6470a94df6d5b8d823/
Threat name:
Script-WScript.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2023-07-06 09:01:50 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
8 of 38 (21.05%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fokfo36rd3zmahprtyixaj2oods4mpoda6kzwzdqvfg7nvny3arq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230707-h5hh5sfg28/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Blocklisted process makes network request
AgentTesla
Malware Config
Dropper Extraction:
http://cryptersandtools.minhacasa.tv/e/e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2b94576fd11ef2c01df19e1170274e70e5c63dc307959b6470a94df6d5b8d823

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 2b94576fd11ef2c01df19e1170274e70e5c63dc307959b6470a94df6d5b8d823

(this sample)

AgentTesla

Visual Basic Script (vbs) vbs bdc3b394b6fa647e13f3b728786c14a58e44af9f174563550a7bab578303d1c8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bdc3b394b6fa647e13f3b728786c14a58e44af9f174563550a7bab578303d1c8
  
Dropping
AgentTesla

Comments