MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 542ac0e3e8b107a26e496d2efa4610be748a51dd1a03bcf51791f83ac458e54a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 542ac0e3e8b107a26e496d2efa4610be748a51dd1a03bcf51791f83ac458e54a
SHA3-384 hash: a6e45b5d8a91a9c247414d3b3243fa2396aefa5705668746c3be5ce9bc474bd6ac22423879b01ec3c73c40a0ba0268cf
SHA1 hash: 2c7e3bb4375b609aab391d42b6e5e35e974433cb
MD5 hash: 04b3f421c0cade3de665dbad9dfe0b4f
humanhash: october-lamp-carpet-lemon
File name:VEL-P01225013B (3).zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:891'301 bytes
First seen:2022-04-14 06:18:02 UTC
Last seen:2022-04-14 07:13:15 UTC
File type: zip
MIME type:application/zip
ssdeep 24576:SZ8nw5JfYcuZvjxG9eXtZJ4C5kVPDtAO2+GxK3R:S6nw5JfYcupxG9ed4FMjxUR
TLSH T1991533A4834B7D6F40FAB4F96C5FC5780C62813F38905745E69253A6DDDEB83C90B8A8
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""Cindy Ang"<cindy.ang@sg.wilmar-intl.com>" (likely spoofed)
Received: "from sg.wilmar-intl.com (unknown [185.222.57.181]) "
Date: "13 Apr 2022 18:42:40 +0200"
Subject: "VSL: Vela, ORDER: VEL-P01225013B, VENDOR: DINTEC SG"
Attachment: "VEL-P01225013B (3).zip"

Intelligence

File Origin
# of uploads :
4
# of downloads :
262
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis2E3F37E38A3E.17859.9813.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6257bc9b482f2f41caac1ee0/reports/a4283cfb-15a5-4704-9cd2-17b4a9ae4a79/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/542ac0e3e8b107a26e496d2efa4610be748a51dd1a03bcf51791f83ac458e54a
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/542ac0e3e8b107a26e496d2efa4610be748a51dd1a03bcf51791f83ac458e54a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-12 08:40:28 UTC
File Type:
Binary (Archive)
Extracted files:
81
AV detection:
25 of 42 (59.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kqvmby7iwed2e3sjnuxpurqqxz2iuuo5dib3z5ixsh4dvrcy4vfa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220414-g2k97ahdfm/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5167639867:AAFp5rpwhccJwSR0NNRceLhFKcs218dT21U/sendDocument
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/542ac0e3e8b107a26e496d2efa4610be748a51dd1a03bcf51791f83ac458e54a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 542ac0e3e8b107a26e496d2efa4610be748a51dd1a03bcf51791f83ac458e54a

(this sample)

AgentTesla

Executable exe f965c51825b3de818f81dd4c5f4b93c6e5d0a8b035e02be55a070013c1f24519

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f965c51825b3de818f81dd4c5f4b93c6e5d0a8b035e02be55a070013c1f24519
  
Dropping
AgentTesla

Comments