MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35248022f594b4c2af73374ce544ab23f99c26471bc8f6fafc898b3f5b5a9639. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35248022f594b4c2af73374ce544ab23f99c26471bc8f6fafc898b3f5b5a9639
SHA3-384 hash: 9c6a10025556ac082b98fee678a8b28ecd7e09f923b2180df23d6b069dcf51adf9af519d4503ee887cf15323fadbd59f
SHA1 hash: 0108507d3d0b28cc4ff6d37284a7a756211d0822
MD5 hash: 4f370156a9c3da91df5c21a228af42ab
humanhash: one-missouri-tennessee-kansas
File name:Midgjuhe.001
Download: download sample
Signature AgentTesla
Create hunting rule
File size:29'941 bytes
First seen:2022-02-11 08:22:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:j1VtzkY6M9ZgnLf5s7Y9R1R+rO6SH0+lrIbIihY:BP4Yl9ZgnO7YL1YRSHTGbNhY
TLSH T150D2F1BC11ADF461F51DA9F66BF358E2A04FF2B840C208DC87ABA0C9DE3EAD59054116
Reporter cocaman
Tags:001 AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "ing.jbarragan@hotmail.com" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [185.222.57.217]) "
Date: "11 Feb 2022 05:32:01 +0100"
Subject: "Quote Order-AS-377578"
Attachment: "Midgjuhe.001"

Intelligence

File Origin
# of uploads :
1
# of downloads :
218
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Downloader.10124.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/62061ce845ddfa2e18bee6b9/reports/2096cf38-ce40-4fb6-9027-1e1de88ca0c0/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/35248022f594b4c2af73374ce544ab23f99c26471bc8f6fafc898b3f5b5a9639
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/35248022f594b4c2af73374ce544ab23f99c26471bc8f6fafc898b3f5b5a9639/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-11 05:12:35 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
23 of 41 (56.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gusiaixvss2mfl3tg5gokrflep4zyjshdpepn6x4rgft6w22sy4q._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220211-j95pxacdb4/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 35248022f594b4c2af73374ce544ab23f99c26471bc8f6fafc898b3f5b5a9639

(this sample)

AgentTesla

Executable exe 4b9320bec4f05c232b2a22cfbe3d8816cdc6b6b069dcc4eaf19cb687c2da657e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4b9320bec4f05c232b2a22cfbe3d8816cdc6b6b069dcc4eaf19cb687c2da657e

Comments