MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c74c934d6e8da3e5968ea367270bf40415ae4a3046b4c504cc694b98a6bf528. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c74c934d6e8da3e5968ea367270bf40415ae4a3046b4c504cc694b98a6bf528
SHA3-384 hash: e10dddef64a9af292411c4152c09b9a80d2564aa8b9567bf1fd0380c3656891d1e52c4a375e9eac0a3dec94ce4f68ea0
SHA1 hash: 95928c65474e70971a08e9bf73e7972042fe89d1
MD5 hash: 80819ac7d6f73b2bcbfd4c088eb12d80
humanhash: magazine-bacon-dakota-nine
File name:GS998M37BeqAVyf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:798'131 bytes
First seen:2021-06-13 05:46:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:1yhFfiyyrJkf4nDQyJPfRuIEwR+HqFI2wMHl:1yh41kf4nDQqnoIEwYHT2jF
TLSH C505231860F5A71AFEAB9496DB005FB4BEC84E1950B7F5B13307D8F655FC42200AA92F
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "lingjing.wang@vahle.com.cn" (likely spoofed)
Received: "from vahle.com.cn (unknown [185.222.57.79]) "
Date: "12 Jun 2021 15:15:29 -0700"
Subject: "RE: WRONG IBAN/PAYMENT RETURNED"
Attachment: "GS998M37BeqAVyf.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
285
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.16337.24514.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/2c74c934d6e8da3e5968ea367270bf40415ae4a3046b4c504cc694b98a6bf528
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c74c934d6e8da3e5968ea367270bf40415ae4a3046b4c504cc694b98a6bf528/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-06-13 05:47:08 UTC
File Type:
Binary (Archive)
Extracted files:
52
AV detection:
15 of 46 (32.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fr2msngw5dnd4wli5i3he4f7ibavvzfdarvuyucmy2kltctl6uua._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210613-h52r4zlrya/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2c74c934d6e8da3e5968ea367270bf40415ae4a3046b4c504cc694b98a6bf528

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2c74c934d6e8da3e5968ea367270bf40415ae4a3046b4c504cc694b98a6bf528

(this sample)

AgentTesla

Executable exe 5819733ed35e38adfd24c6c0b9da7efcc49e611b82c3fa5ab3e716c3fe63d295

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5819733ed35e38adfd24c6c0b9da7efcc49e611b82c3fa5ab3e716c3fe63d295

Comments