MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38e3e1fe8bc65785af2741e0b87bb8a4b5e90d05f2d8a19e12d4ec00a327b42c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38e3e1fe8bc65785af2741e0b87bb8a4b5e90d05f2d8a19e12d4ec00a327b42c
SHA3-384 hash: 25a7b5e3fe920e7d6f02a4ca6a45b8786fb9ef555c6b43ccc095cf6d22e34311712021fa80967c298a4ea938ea11afe5
SHA1 hash: 06924ed7f577c693e9d2982d003e653cd424011c
MD5 hash: 630855ebd267f5d6036f02abd1a09724
humanhash: hawaii-winner-failed-early
File name:HL-88352988 DOCAU BC ORIGINAL.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:793'653 bytes
First seen:2021-04-26 05:30:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Cj1RKgVUTTDNed1WlifPHQi32hZeGj4Vvhq+1OBbiQSxWG4IElu54RhCSPoe6D:CsNe6ifPhG2v/ebK8G4IERRhUeg
TLSH 93F423E7B3E8EE5A61ABB81A0F9A02B637BE73115CD99EC7FC96401CC59005B51035F4
Reporter cocaman
Tags:AgentTesla zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.18772.21226.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/38e3e1fe8bc65785af2741e0b87bb8a4b5e90d05f2d8a19e12d4ec00a327b42c
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/38e3e1fe8bc65785af2741e0b87bb8a4b5e90d05f2d8a19e12d4ec00a327b42c/
Threat name:
ByteCode-MSIL.Infostealer.Coins
Create hunting rule
Status:
Malicious
First seen:
2021-04-26 05:30:16 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
3 of 47 (6.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hdr6d7ulyzlyllzhihqlq65yus26sdif6lmkdhqs2twabizhwqwa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210426-6fh3n1nzg6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/38e3e1fe8bc65785af2741e0b87bb8a4b5e90d05f2d8a19e12d4ec00a327b42c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 38e3e1fe8bc65785af2741e0b87bb8a4b5e90d05f2d8a19e12d4ec00a327b42c

(this sample)

AgentTesla

Executable exe 766275310a4cda56d3ac5765fba22cddae40c0e27da6bbe71db6c5ce160632f9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 766275310a4cda56d3ac5765fba22cddae40c0e27da6bbe71db6c5ce160632f9
  
Dropping
AgentTesla

Comments