MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43a0448a17cb2e6d8fac6cb69ad4382faf8acf0f343600e644d8c82ce688e068. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43a0448a17cb2e6d8fac6cb69ad4382faf8acf0f343600e644d8c82ce688e068
SHA3-384 hash: 5d495db93d73a0d5a233359278546a60f564a248261a5afebff74ab58975b129d4f6802429880ba4c83898cda7b987cf
SHA1 hash: 6c2c33d4988c8f2bac6aef79bdb96eb78749d376
MD5 hash: 365381730d83d398fea01e3e6d5cffc3
humanhash: potato-nuts-alabama-north
File name:Payment voucher. pdf......................gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:408'447 bytes
First seen:2021-09-13 15:21:22 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:+Slq6MJRsjkes/o830wYT0UGZCgZd/XUBWgGHhEKaRFM1o7+eUIy9Dr9l:fl2Rrp3RDUgCgZdxdRuKeUIcNl
TLSH T1549423238D7F30506CAA8CBF5FA2156B97D6A27DE3B142F7E9AE12D10E80AC1550F019
Reporter fabjer
Tags:AgentTesla gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
215
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6175031b9a5a1e91c5d1fd1a/reports/24e4cc49-5d2e-4e29-959c-e1e48b39c00b/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/43a0448a17cb2e6d8fac6cb69ad4382faf8acf0f343600e644d8c82ce688e068/
Threat name:
Win32.Trojan.Mardom
Create hunting rule
Status:
Malicious
First seen:
2021-09-13 04:30:14 UTC
AV detection:
12 of 45 (26.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ioqejcqxzmxg3d5mns3jvvbyf6xyvtypgq3abzse3deczzui4bua._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210913-srwtqahagr/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/43a0448a17cb2e6d8fac6cb69ad4382faf8acf0f343600e644d8c82ce688e068

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 43a0448a17cb2e6d8fac6cb69ad4382faf8acf0f343600e644d8c82ce688e068

(this sample)

AgentTesla

Executable exe a600f4cfa88c6003d085b5963b28594960e632da929a4f5b7807072182b93d3a

  
Dropping
SHA256 a600f4cfa88c6003d085b5963b28594960e632da929a4f5b7807072182b93d3a
  
Delivery method
Distributed via e-mail attachment

Comments