MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4bde9f43841d29ce72a20deec55e7081f0c387ebfcdf24ab2e2af88e298d79d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4bde9f43841d29ce72a20deec55e7081f0c387ebfcdf24ab2e2af88e298d79d0
SHA3-384 hash: 283069cac68cb07873853b1ebf687076598d0b8d75471af7c4351efe74f03e62a82024d4daa2a5ae200ed9843e5e1d90
SHA1 hash: e0202be5edf277b255681bbb6fa50949661336ea
MD5 hash: f56f1bd0d91977a6bc17688269215fcb
humanhash: earth-happy-whiskey-magazine
File name:AWB & Invoice #1006472.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:768'634 bytes
First seen:2022-07-20 07:23:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Na+d8enfiG0YXmSzsXc26b6vqyE7moQ/RDVPk6IS6tCZs9Y6N6FxwWfrHm8+G:gBG6lY5zmRDL2mG6zZHRK4
TLSH T168F42326E40C0F43D744794B6A2E81CA759AEF605CA9BFF3E1170839FA81B657813D27
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla INVOICE Shipping zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Anastasia Ivanova <c_shipping@msc.com>" (likely spoofed)
Received: "from msc.com (unknown [74.201.28.113]) "
Date: "20 Jul 2022 09:22:44 +0200"
Subject: "Shipping documents (AWB & Invoice)"
Attachment: "AWB & Invoice #1006472.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2087.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Packed2.44341.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62d7addfef2b0e63a828e86d/reports/5f40ca92-a0fd-48cd-887e-77380b5af517/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/4bde9f43841d29ce72a20deec55e7081f0c387ebfcdf24ab2e2af88e298d79d0
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4bde9f43841d29ce72a20deec55e7081f0c387ebfcdf24ab2e2af88e298d79d0/
Threat name:
ByteCode-MSIL.Spyware.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2022-07-20 06:18:23 UTC
File Type:
Binary (Archive)
Extracted files:
25
AV detection:
21 of 39 (53.85%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jppj6q4eduu444vcbxxmkxtqqhymhb7l7tpsjkzofl4i4kmnphia._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220720-h8ddladefr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4bde9f43841d29ce72a20deec55e7081f0c387ebfcdf24ab2e2af88e298d79d0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4bde9f43841d29ce72a20deec55e7081f0c387ebfcdf24ab2e2af88e298d79d0

(this sample)

AgentTesla

Executable exe 0fe48a175b79a47314cc8ef8d5768e0a911e08da6b855faba6b41ec82bdebc4b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0fe48a175b79a47314cc8ef8d5768e0a911e08da6b855faba6b41ec82bdebc4b
  
Dropping
MD5 839bc500771a397808b8c7c2c3cd3836

Comments