MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e66455f753ec96abfce81d9b5892c7de1ba00cd9526597c7cf25d509fb1d50c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e66455f753ec96abfce81d9b5892c7de1ba00cd9526597c7cf25d509fb1d50c
SHA3-384 hash: 31231a267b7eaec86fa4d8ab8bee68b877722850b8f329d376351274ab38e7c632525b9f0f48fdfbda1d9978d6d50c75
SHA1 hash: 2e2805038a93846280d14bb16126605624f66680
MD5 hash: e9242205ff8beebea79ae6ec841d7fec
humanhash: oxygen-fillet-ack-lactose
File name:quotation.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:476'390 bytes
First seen:2022-07-27 06:34:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:1SXDn3Kl3E+YqX9HRX38Xd+WJ4yneMhknSrBOCJgl2soE0wn4likGt1GH+j9v3rF:1Gn3Kq+j91Udj4wn4lwptE0sSHuA+trF
TLSH T132A423914449C23FC48C9A919C2064D7E0F0B5A5DF9AD22744D366E1FEADE6EF6B3203
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla QUOTATION zip


Avatar
cocaman
Malicious email (T1566.001)
From: "syahirah@listensecurity.com.my" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.240]) "
Date: "27 Jul 2022 07:06:46 +0200"
Subject: "Quotation & agreement for convenience."
Attachment: "quotation.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
214
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.31834.9901.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62e0dce8cfc3051676904a2b/reports/7bbcaf96-cf8c-4e58-8c21-42c6a87f5626/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/3e66455f753ec96abfce81d9b5892c7de1ba00cd9526597c7cf25d509fb1d50c
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e66455f753ec96abfce81d9b5892c7de1ba00cd9526597c7cf25d509fb1d50c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-07-27 05:11:14 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hztekx3vh3ewvp6oqhm3lcjmpxq3uagnsutfs7d46jovbh5r2uga._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220727-hcb6nabbeq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3e66455f753ec96abfce81d9b5892c7de1ba00cd9526597c7cf25d509fb1d50c

(this sample)

AgentTesla

Executable exe d467bfa9ec5c3d63189dbd0c3ef7cf377d2a3fc16207db32aaf5e0bdae81d2a4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d467bfa9ec5c3d63189dbd0c3ef7cf377d2a3fc16207db32aaf5e0bdae81d2a4
  
Dropping
MD5 c8304d98e0cf27e6cb79aa1b9eda2ec0

Comments