MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46726c1e464f06e46ceaf9e928c84dbb2f7daad17e8cce345d67b9509168863b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46726c1e464f06e46ceaf9e928c84dbb2f7daad17e8cce345d67b9509168863b
SHA3-384 hash: b2f0ebc936f0ab74147c3f07e06f8afb7ef43da61ddec3f2aba8599a9d1064407f42ff541141d3743ba95d9bd33ba3ca
SHA1 hash: 1ae7ef0167ad907393f80befe57ffbaa2afd00dd
MD5 hash: 7bc14ed97b8cb03cc80976e33e1b7a8b
humanhash: pasta-magnesium-carolina-nebraska
File name:PO.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:405'267 bytes
First seen:2022-05-17 08:24:18 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:8CetrmU+7/uwhlzEA7qb/cnlO0DCC+jOV+:Fmw/Pz7qulOgCC+jOV+
TLSH T171842366305E7505A6B34412ACFD6EB8C79529914D5FA44FF30CF2632363B8BDB2C289
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""sales1" <sales1@attelec.com>" (likely spoofed)
Received: "from attelec.com (unknown [45.137.22.229]) "
Date: "17 May 2022 01:44:35 +0200"
Subject: "**SPAM** NEW ORDER / PO - 108"
Attachment: "PO.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe obfuscated packed shell32.dll
Link:
https://www.filescan.io/uploads/62835bead06ea2f4a0722b94/reports/48bbd274-0eeb-4897-8798-36a668f054bc/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/46726c1e464f06e46ceaf9e928c84dbb2f7daad17e8cce345d67b9509168863b
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46726c1e464f06e46ceaf9e928c84dbb2f7daad17e8cce345d67b9509168863b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-17 00:00:44 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
20 of 41 (48.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=izzgyhsgj4doi3hk7husrscnxmxx3kwrp2gm4nc5m64vbeliqy5q._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220517-kbabsahdb4/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/46726c1e464f06e46ceaf9e928c84dbb2f7daad17e8cce345d67b9509168863b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 46726c1e464f06e46ceaf9e928c84dbb2f7daad17e8cce345d67b9509168863b

(this sample)

AgentTesla

Executable exe 2d2d52ba1a0550416131412156d24dcf1e556ecd94feb13f770af0466cafa32a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2d2d52ba1a0550416131412156d24dcf1e556ecd94feb13f770af0466cafa32a
  
Dropping
AgentTesla

Comments