MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 390cb3ef50509c6f87645db7046118156aa18af8027f80363a36ce3bf4077170. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 390cb3ef50509c6f87645db7046118156aa18af8027f80363a36ce3bf4077170
SHA3-384 hash: d1cb7755f22ddbee61e5447f8ad8ea88987aac7373325cbfb20aa261e0bff476313ca571edb262100ee5a71a40ca4fd0
SHA1 hash: a307ed438d393e7ebba7d68db4eaf40019d1f19a
MD5 hash: b6e28d3ba7c758e56c26711b5b878f92
humanhash: nevada-idaho-king-asparagus
File name:P0.r15
Download: download sample
Signature AgentTesla
Create hunting rule
File size:522'011 bytes
First seen:2022-02-03 07:56:25 UTC
Last seen:2022-02-03 07:57:10 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:lOYzGaegm7sLovJJSQkwgPAx+vcHM5geor9eJ:oYzGaeg5cv/SQxC0HM5gzrMJ
TLSH T13AB423664BFEA15144E88C5B08EF17E712ADA2F0271F58ED32D64CB7F450B89630DB16
Reporter cocaman
Tags:AgentTesla r15 rar


Avatar
cocaman
Malicious email (T1566.001)
From: "wuchuan@pridametal.com" (likely spoofed)
Received: "from pridametal.com (unknown [45.137.22.124]) "
Date: "03 Feb 2022 02:57:11 +0100"
Subject: "RE: Purchase Order"
Attachment: "P0.r15"

Intelligence

File Origin
# of uploads :
3
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61fb8ad618d1bfdde4eecadc/reports/8a64580d-897d-4ee5-bd35-5833908f838b/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/390cb3ef50509c6f87645db7046118156aa18af8027f80363a36ce3bf4077170/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-03 01:06:27 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
17 of 27 (62.96%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=heglh32qkcog7b3elw3qiyiycvvkdcxyaj7yanr2g3hdx5ahofya._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220203-jtbf5aeeb4/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Drops file in Drivers directory
Sets service image path in registry
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/390cb3ef50509c6f87645db7046118156aa18af8027f80363a36ce3bf4077170

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 390cb3ef50509c6f87645db7046118156aa18af8027f80363a36ce3bf4077170

(this sample)

AgentTesla

Executable exe 6529c08aa108399edf5f1309fe6d9a56fc484c30cad0ff80c9e0fb0f01cb545e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6529c08aa108399edf5f1309fe6d9a56fc484c30cad0ff80c9e0fb0f01cb545e

Comments