MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40760bd5e2b8a663de1bd0a499100c4ae2379e188e8675c113935e6ee6fe5430. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40760bd5e2b8a663de1bd0a499100c4ae2379e188e8675c113935e6ee6fe5430
SHA3-384 hash: 36bd03f45da79e6f373b703b956bd7aafe212ebdcdcb54dc29155729548f9c87f13c567f63f37ca2acd797b5f11ce1e5
SHA1 hash: b722dc07e079dc8cb76cd0bc59b17ecb5e9b48de
MD5 hash: 0f3f75fd3f2f2623ad18032d7f58811f
humanhash: lemon-low-violet-social
File name:Quotation.001
Download: download sample
Signature AgentTesla
Create hunting rule
File size:932'675 bytes
First seen:2022-04-19 11:50:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:d3siaKLqGcM4f+diPf8gJd8cVF5i6Eff2uAFAr:d1a5GcMxdiPfJhvLu8q
TLSH T14A15337C755F5B016C2681D04A2CA1AAFD7B084C3EE8F6006EC9F994871729A45DF4BF
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:001 AgentTesla QUOTATION rar


Avatar
cocaman
Malicious email (T1566.001)
From: "bessie <bessie@smaraadenergy.com>" (likely spoofed)
Received: "from smaraadenergy.com (unknown [185.222.57.233]) "
Date: "19 Apr 2022 11:53:06 +0200"
Subject: "Re: Quotation"
Attachment: "Quotation.001"

Intelligence

File Origin
# of uploads :
1
# of downloads :
270
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe obfuscated packed
Link:
https://www.filescan.io/uploads/625ea227eab80a7a6c41211b/reports/e15d5c12-34b8-4cb7-a8bf-d10fa8eca4f5/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/40760bd5e2b8a663de1bd0a499100c4ae2379e188e8675c113935e6ee6fe5430/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-19 08:25:35 UTC
File Type:
Binary (Archive)
Extracted files:
48
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ib3axvpcxctghxq32csjseamjlrdphqyr2dhlqitsnpg5zx6kqya._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220419-nz5z5sade2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/40760bd5e2b8a663de1bd0a499100c4ae2379e188e8675c113935e6ee6fe5430

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 40760bd5e2b8a663de1bd0a499100c4ae2379e188e8675c113935e6ee6fe5430

(this sample)

AgentTesla

Executable exe d7c4cac506f73fe95bd0caa611e5bc75d32c89d8f99f69fd7a13e633f9f2e374

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d7c4cac506f73fe95bd0caa611e5bc75d32c89d8f99f69fd7a13e633f9f2e374
  
Dropping
AgentTesla

Comments