MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44788b7fa546e301e226ffb82982a2e621139bdfe697d31f0003b0bea2fba5f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44788b7fa546e301e226ffb82982a2e621139bdfe697d31f0003b0bea2fba5f0
SHA3-384 hash: a268a8b68d10293929e1475d7145da3794efe8a86ae269c706851f32c527dac6012b886e103f7168040f4385280fd0e5
SHA1 hash: 0c076e866ff5ef8508e6016829a44c237f8276a8
MD5 hash: 5bbf1ac7511f74613fce70d43ac6662d
humanhash: sixteen-juliet-snake-alabama
File name:SOA.r15
Download: download sample
Signature AgentTesla
Create hunting rule
File size:439'126 bytes
First seen:2022-03-17 14:17:31 UTC
Last seen:2022-03-17 14:18:21 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:h2N04b1cEWJJGtSde3hNGQyu9hEhx6UtbCdbTGs:UN/b1tPtSdeLyAhktCnH
TLSH T1149423CAC828DAE84DEE486CB6E3455B5534BBBC11C7EE638F4EE108940D37D2A4DE51
Reporter cocaman
Tags:AgentTesla r15 rar


Avatar
cocaman
Malicious email (T1566.001)
From: "shuai_sun@secote.com" (likely spoofed)
Received: "from secote.com (unknown [45.137.22.153]) "
Date: "17 Mar 2022 14:49:47 +0100"
Subject: "RE: Balance Payment"
Attachment: "SOA.r15"

Intelligence

File Origin
# of uploads :
3
# of downloads :
211
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/62334321b94fb38cb4994d9e/reports/6a66dae0-60e1-4f2f-8609-bc27756de255/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44788b7fa546e301e226ffb82982a2e621139bdfe697d31f0003b0bea2fba5f0/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-03-17 14:18:13 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
18 of 27 (66.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ir4iw75fi3rqdyrg764ctavc4yqrhg6742l5ghyaaoyl5ix3uxya._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220317-rmaj9acbfl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Drops file in Drivers directory
AgentTeslaV3
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/44788b7fa546e301e226ffb82982a2e621139bdfe697d31f0003b0bea2fba5f0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 44788b7fa546e301e226ffb82982a2e621139bdfe697d31f0003b0bea2fba5f0

(this sample)

AgentTesla

Executable exe 1eb4d690d116a9129704cc98c4cb900a399ae26c601bf9e8764aa713c01250b8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1eb4d690d116a9129704cc98c4cb900a399ae26c601bf9e8764aa713c01250b8

Comments