MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f700076d58e203f5ec97282bd71e09124199f9462c25f7d1c78872e2836acfa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f700076d58e203f5ec97282bd71e09124199f9462c25f7d1c78872e2836acfa
SHA3-384 hash: d561d70aa0382ebd7a244493965266b4c377efb6381083e07aa33870d2a2ff2941a0f34affe8c2b9fc42651f6ee1d1ea
SHA1 hash: 8d26916a88c57ad6c1778a2cc447d2514008522c
MD5 hash: ab4d94fa5095144b7a7045be91a65d59
humanhash: august-ten-purple-maryland
File name:NEW PURCHASE ORDER.r17
Download: download sample
Signature AgentTesla
Create hunting rule
File size:418'096 bytes
First seen:2022-02-02 13:55:52 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:9IV6unaEKyuqoE4CBSSbwEYYKQsnbolOxG:/uaEcUr3Jsbolj
TLSH T1559423BCE50AD67C5FA9FA7E35AC8D8B468C43A12359E3323EA120374D3CD16D13546A
Reporter cocaman
Tags:AgentTesla r17 rar


Avatar
cocaman
Malicious email (T1566.001)
From: "rayvas@maltanet.net" (likely spoofed)
Received: "from maltanet.net (unknown [185.222.58.47]) "
Date: "02 Feb 2022 11:14:17 +0100"
Subject: "RE: NEW PURCHASE ORDER / SAMPLE PRODUCTS"
Attachment: "NEW PURCHASE ORDER.r17"

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe obfuscated packed
Link:
https://www.filescan.io/uploads/61fa8d816d25ac9e79fc6580/reports/2229e016-b183-4262-91a7-26780683539b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f700076d58e203f5ec97282bd71e09124199f9462c25f7d1c78872e2836acfa/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-02 08:54:44 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j5yaa5wvryqd6xwjokbl24pasesbth4umlbf67i4pcds4kbwvt5a._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220202-q8pqmaaben/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Drops file in Drivers directory
Sets service image path in registry
AgentTesla Payload
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/sendDocument
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/4f700076d58e203f5ec97282bd71e09124199f9462c25f7d1c78872e2836acfa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 4f700076d58e203f5ec97282bd71e09124199f9462c25f7d1c78872e2836acfa

(this sample)

AgentTesla

Executable exe cdb165540d32c40691d0f199329a381a04c61cec71c10eb53b1cc4aa1c6cb92c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cdb165540d32c40691d0f199329a381a04c61cec71c10eb53b1cc4aa1c6cb92c

Comments