MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4bb77389193dcb659a85c5bf3711443f9ad4493262e02943444d19a3394e60b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4bb77389193dcb659a85c5bf3711443f9ad4493262e02943444d19a3394e60b3
SHA3-384 hash: 114c4605dc7aa5d5a1d726dcc3e5390b56dc871e6ede5edcf27b62fa05315e779999d0deb8f90e357bf85077da26fcae
SHA1 hash: a3862e9585b0774b74fee56438415ba0edd226f7
MD5 hash: dda6a90ff559822ef0d3dadbfd2ff707
humanhash: mirror-east-texas-blossom
File name:PO-120220052.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:428'389 bytes
First seen:2022-04-29 10:36:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:gGDulkbUhy0R3B3ZIfVOTHBK+eiObmmVLSNRZFzA3vdpi:gSu6Gy0+wBNeiOam1SXA3vni
TLSH T17494235B386C3F51FBB85B04C5A9810BAA37F38E553825C7E2EC08E80512D2FAA57D75
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""Sandy Hsieh" <sandy.hsieh@yanhing.com>" (likely spoofed)
Received: "from yanhing.com (unknown [103.149.12.236]) "
Date: "25 Apr 2022 10:21:26 -0700"
Subject: "Purchase Order No. I20220052 Dt. 19.04.2022"
Attachment: "PO-120220052.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2268.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.W32.AIDetectNet.01.15766.15991.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fareit obfuscated packed
Link:
https://www.filescan.io/uploads/626bbfce0d3e2bd52d13a4be/reports/a67314bb-ded6-4a17-a567-b92d26d981a0/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/4bb77389193dcb659a85c5bf3711443f9ad4493262e02943444d19a3394e60b3
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4bb77389193dcb659a85c5bf3711443f9ad4493262e02943444d19a3394e60b3/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-25 18:15:17 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
24 of 42 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jo3xhcizhxfwlgufyw7toekeh6nnisjsmlqcsq2ejum2gokomczq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220429-mnsp1aeegl/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.54
Link:
https://yomi.yoroi.company/submissions/4bb77389193dcb659a85c5bf3711443f9ad4493262e02943444d19a3394e60b3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4bb77389193dcb659a85c5bf3711443f9ad4493262e02943444d19a3394e60b3

(this sample)

AgentTesla

Executable exe 6dec2de4134fbbd9b62af9bfcfd0e6500875328196ef945d805f2480d0521a98

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6dec2de4134fbbd9b62af9bfcfd0e6500875328196ef945d805f2480d0521a98
  
Dropping
AgentTesla

Comments