MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2cf709ace0280783623acbc9fb826c931a647c3305fc1e1a1c3f9411638d386e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2cf709ace0280783623acbc9fb826c931a647c3305fc1e1a1c3f9411638d386e
SHA3-384 hash: 3bb7b2ce1d76bf23e447a5bb0871bba50a5eed33176b7619d6ddc5fd5fdd087daee5e64618eb6419bf021da7abfc5506
SHA1 hash: e6436ab05cbba52c96e72cb3a1b13893e4420d05
MD5 hash: e70513263c05bd04bede761b22ab4609
humanhash: delta-tennis-social-california
File name:ARIX SRLVl (MN) - Italy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:746'777 bytes
First seen:2021-04-27 14:23:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:I3CyCV4mghS5vmwc6a25ZEhbsnTernVbMepuDep2jk6U6ufWAYqd:IUd8D6a25Kg6rn+e72jk7XYQ
TLSH 55F4339AF83F1F1878D16C939BB3E51CF810846619E5AD7B673A41C19D630B28FBC921
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "<sanjeev.shukla@bioayurveda.in>" (likely spoofed)
Received: "from bioayurveda.in (unknown [185.222.57.90]) "
Date: "27 Apr 2021 07:22:39 -0700"
Subject: "Orders From Export Manager EU & Overseas Marketers"
Attachment: "ARIX SRLVl (MN) - Italy.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/2cf709ace0280783623acbc9fb826c931a647c3305fc1e1a1c3f9411638d386e
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2cf709ace0280783623acbc9fb826c931a647c3305fc1e1a1c3f9411638d386e/
Threat name:
ByteCode-MSIL.Infostealer.Coins
Create hunting rule
Status:
Malicious
First seen:
2021-04-27 11:12:19 UTC
File Type:
Binary (Archive)
Extracted files:
39
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ft3qtlhafadygyr2zpe7xatmsmngi7btax6b4gq4h6kbcy4nhbxa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210427-8ap4zlt42x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.56
Link:
https://yomi.yoroi.company/submissions/2cf709ace0280783623acbc9fb826c931a647c3305fc1e1a1c3f9411638d386e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2cf709ace0280783623acbc9fb826c931a647c3305fc1e1a1c3f9411638d386e

(this sample)

AgentTesla

Executable exe 78b89b05c3beb9d8275a36c785e9f629241c37768d3eca480ad18cd61cee01a3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 78b89b05c3beb9d8275a36c785e9f629241c37768d3eca480ad18cd61cee01a3
  
Dropping
AgentTesla

Comments