MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3068aa27783e9afcacece2867ef00fd83615a73d707b921de428cabb83b20585. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3068aa27783e9afcacece2867ef00fd83615a73d707b921de428cabb83b20585
SHA3-384 hash: 1e3170f3b2ef05752126e11727c7aa04e5d35d25c94163d4b8860e0d308eee6392ef8fc9130a38fca25b6d7027b98cb6
SHA1 hash: a1e35f3b2f3798e504938e3e4a7e51b8ee30d4aa
MD5 hash: a1803ac8a092c0e6828db71bd241759a
humanhash: william-louisiana-eleven-aspen
File name:PO-4147074.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:581'203 bytes
First seen:2021-04-19 07:56:16 UTC
Last seen:2021-04-20 05:09:17 UTC
File type: gz
MIME type:application/gzip
ssdeep 12288:H1D/viYLyNaPLM32KwGD3bRpIdLD9ygNO1Vx4Dp7p3PZRFn0lC98:H1DHiYGNgTuD1mdLD9KL27p3PZRFBC
TLSH DFC4237EDEE3153CCFD6568246E31AF3B2D014BD368C0AD41A72C7D959312AD70922AB
Reporter lowmal3
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3068aa27783e9afcacece2867ef00fd83615a73d707b921de428cabb83b20585/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gbukuj3yh2npzlhm4kdh54ap3a3bljz5ob5zehpefdflxa5sawcq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210419-8rm9ac3r76/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
AgentTesla Payload
Looks for VirtualBox Guest Additions in registry
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3068aa27783e9afcacece2867ef00fd83615a73d707b921de428cabb83b20585

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 3068aa27783e9afcacece2867ef00fd83615a73d707b921de428cabb83b20585

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments