MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4af82b61d65b98b772347d9ceb7c99d521823bc90dd2f7dae76f92e74d3d11ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4af82b61d65b98b772347d9ceb7c99d521823bc90dd2f7dae76f92e74d3d11ac
SHA3-384 hash: ddf321c835f6fd232a2901effb3838ec002fe3ae8491dcf5b64363e096b96d89b1110407c475e6f36405ce01cc3ff251
SHA1 hash: 80949f111055ffd28101e4e52a6a2aa044022004
MD5 hash: adab1aed6096170a0b87986fc3e064ac
humanhash: harry-london-oklahoma-december
File name:SOA.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:399'028 bytes
First seen:2022-08-16 16:17:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:5nB+qRnD0QKJvlZ909PAsDDYSc4gY7pQUDC6vCn:WQ8MxD8H4gY7pO7
TLSH T1BF842394F3548BE57DB9D26444EE0D5B42FDCF73060DEC9AE1C92AE82BA1C509C7B620
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla INVOICE zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""Tshepong Manager" <tshepongmanager@witsmhs.co.za>" (likely spoofed)
Received: "from witsmhs.co.za (unknown [103.170.255.231]) "
Date: "12 Aug 2022 12:38:50 -0700"
Subject: "July 2022 invoices and Statements - Tshepong"
Attachment: "SOA.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
281
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1292.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Siggen18.35079.5814.20853.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm packed
Link:
https://www.filescan.io/uploads/62fbc33e9013ab2e3d051cb8/reports/e04ad262-2028-4cdf-bcf9-15b11f4af25e/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/4af82b61d65b98b772347d9ceb7c99d521823bc90dd2f7dae76f92e74d3d11ac
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4af82b61d65b98b772347d9ceb7c99d521823bc90dd2f7dae76f92e74d3d11ac/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-08-12 17:55:01 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jl4cwyowlomlo4rupwoow7ez2uqyeo6jbxjppwxhn6jootj5cgwa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220816-trx78aecb3/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5400730219:AAF6yJi-sq4as7PeSLNrtiGC96YCaGma0y8/sendDocument
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4af82b61d65b98b772347d9ceb7c99d521823bc90dd2f7dae76f92e74d3d11ac

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4af82b61d65b98b772347d9ceb7c99d521823bc90dd2f7dae76f92e74d3d11ac

(this sample)

AgentTesla

Executable exe 21fac12f018b7932927310c7f3c44f1b56dd40a2abf0ca18902dfbdf7e169345

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 21fac12f018b7932927310c7f3c44f1b56dd40a2abf0ca18902dfbdf7e169345
  
Dropping
AgentTesla

Comments