MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f7e3dd0a5d0ae1fd5e216b360ed459a0304251378cb3818353495b50fef5094. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3f7e3dd0a5d0ae1fd5e216b360ed459a0304251378cb3818353495b50fef5094
SHA3-384 hash: c1d24f85d715b86fd38900be83b0bcac85f3a586f645fcc6c1f1c2c058d07f6664f487062354c09e6d35cac1aa427c8d
SHA1 hash: 4491df15ddd15bba138b27a59db8c5bd1b4a4ed6
MD5 hash: 0d2ecb25207eff31ec77d7e6f075ec0e
humanhash: item-saturn-ohio-angel
File name:IMG_001 IMG_SCAN.JPG.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:671'744 bytes
First seen:2021-04-22 05:47:27 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:cyZEzRRRRRjwiScqTRPIh9yJ+EZedcqcNgktzvDYl3jjYRak8q:0RRRRRjo/tI21edcuktzElj8Rkq
TLSH 35E4BE1912844B97C5DEA9B4CC24D3408BF77B12B716EF8A79B870BC4EC33579B42662
Reporter cocaman
Tags:AgentTesla iso


Avatar
cocaman
Malicious email (T1566.001)
From: ""SALES" <sales@lgpartner.ch>" (likely spoofed)
Received: "from lgpartner.ch (unknown [195.140.213.112]) "
Date: "22 Apr 2021 03:43:20 +0200"
Subject: "Top Urgent"
Attachment: "IMG_001 IMG_SCAN.JPG.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2061.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3f7e3dd0a5d0ae1fd5e216b360ed459a0304251378cb3818353495b50fef5094/
Threat name:
ByteCode-MSIL.Trojan.Phonzy
Create hunting rule
Status:
Malicious
First seen:
2021-04-21 23:04:34 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
20 of 46 (43.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h57d3uff2cxb7vpcc2zwb3kftibqijitpdftqgbvgsk3kd7pkcka._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210422-frdjxj1vaj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot1652586889:AAH8lHbzvtT4QjX1_-3uSZQlT1RC65TAqMU/sendDocument
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3f7e3dd0a5d0ae1fd5e216b360ed459a0304251378cb3818353495b50fef5094

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 3f7e3dd0a5d0ae1fd5e216b360ed459a0304251378cb3818353495b50fef5094

(this sample)

AgentTesla

Executable exe 9b3e4327c19bd28f38df34eaceef8611d9268cf95aea1fd2a026b26e57ca5ab4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9b3e4327c19bd28f38df34eaceef8611d9268cf95aea1fd2a026b26e57ca5ab4
  
Dropping
AgentTesla

Comments