MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a6f5cd0562d515f27aace0fa5029f6408d6f712c627404df22bf34dc3408302. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a6f5cd0562d515f27aace0fa5029f6408d6f712c627404df22bf34dc3408302
SHA3-384 hash: 7fccc5756caa13a2ff610f85b9983bbc851ad2d85488f75720a582a9965b52e11a24cd0c80d34d5cc12763847d1f28e0
SHA1 hash: 789b220f62b8680e9b0157293ce8219a113bda2b
MD5 hash: 92b3592c5d8d1637aa36701a52ed60a1
humanhash: tennis-bacon-sweet-ink
File name:Outstanding Statement-0413.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:723'149 bytes
First seen:2021-04-20 20:18:47 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 12288:4l1ANTfDO+gRjlpIoob0p2NsUYJXJ5KjVuws/1nL8q7ATGHbl2PK+dB+1IQnETC7:4c1LOBplpAnNsjXJ5K8wS1L3ECydBKEm
TLSH 82F4231303A2A646C22E230F478E3A22556D4B7C36E45AE7D4751B79FA2E05D2DFDE0C
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.658-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a6f5cd0562d515f27aace0fa5029f6408d6f712c627404df22bf34dc3408302/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-21 04:53:35 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jjxvzucwfviv6j5kzyh2kau7mqenn5ysyytuatpsfpzu3q2aqmba._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210420-pmvmchmnsx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a6f5cd0562d515f27aace0fa5029f6408d6f712c627404df22bf34dc3408302

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 4a6f5cd0562d515f27aace0fa5029f6408d6f712c627404df22bf34dc3408302

(this sample)

AgentTesla

Executable exe 08caa9af8bc3d72fc768962c2319b86c9712a2437e6ca0e7cca8fc1049536def

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 08caa9af8bc3d72fc768962c2319b86c9712a2437e6ca0e7cca8fc1049536def
  
Dropping
MD5 d1a4c4d05ecd22dc4911c2d2a95a4e05

Comments