MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fed11bcfa0ec80fa94626f65c9b397d2117782bc5efae636e3ee0462ca9e42d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 3fed11bcfa0ec80fa94626f65c9b397d2117782bc5efae636e3ee0462ca9e42d
SHA3-384 hash: 0ac91e2f4acd3cf0b4934662b2fd7f01f6f01373faca1bbeac85156337de5d946fad7f07c1726f63ae0acbd316849a61
SHA1 hash: a2601f58f3659593da9c113b05a082d79b10cd73
MD5 hash: cfe564351e6b4077a2408967ed77deec
humanhash: four-romeo-mango-robert
File name:Bank details.pdf.xlx.bat
Download: download sample
Signature AgentTesla
File size:468'992 bytes
First seen:2020-06-24 12:05:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 12288:LQNMfwQpWCLYCh82nm7DlIbSdPvcX4VO/4oU:cNs/vmm+HPO/45
TLSH 8CA4F11B36A8FE27C53D05F994C45B8513B6A9AE7642F2CA0CD071E528C3BF649226C7
Reporter @abuse_ch
Tags:AgentTesla bat


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: delivery.mailspamprotection.com
Sending IP: 146.66.121.218
From: Asser Amin <asser.amin@electrotech.com.eg>
Reply-To: Asser Amin <asser.amin@electrotech-com.ml>
Subject: our bank account information
Attachment: Bank details.pdf.xlx.r09 (contains "Bank details.pdf.xlx.bat")

AgentTesla SMTP exfil server:
mail.climasenmonterrey.com.mx:587

AgentTesla SMTP exfil email address:
warehousee@climasenmonterrey.com.mx

Intelligence


File Origin
# of uploads :
1
# of downloads :
47
Origin country :
FR FR
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Launching the process to change network settings
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-06-24 10:37:51 UTC
AV detection:
26 of 31 (83.87%)
Threat level
  5/5
Result
Malware family:
agenttesla
Score:
  10/10
Tags:
spyware persistence keylogger trojan stealer family:agenttesla
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Modifies service
Reads user/profile data of web browsers
Reads data files stored by FTP clients
Reads user/profile data of local email clients
AgentTesla

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 3fed11bcfa0ec80fa94626f65c9b397d2117782bc5efae636e3ee0462ca9e42d

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments