MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5b285743304cac5d9ddf35a954d342538994caf81051bbf1f44ec2ad79e22566. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 7
| SHA256 hash: | 5b285743304cac5d9ddf35a954d342538994caf81051bbf1f44ec2ad79e22566 |
|---|---|
| SHA3-384 hash: | 618aede8c74bab0affb17c7066e9e52f7021c381c6497fe126ace7e639472697ff88547570f4b04c323305bcea2a0300 |
| SHA1 hash: | 3d013ae1a19adb7195be79da3912a195b4a022be |
| MD5 hash: | 9ffe01ce1274e4fd6ec5acdfbcc23d07 |
| humanhash: | vegan-fix-ceiling-august |
| File name: | SHIPPING ADVICE#202204.zip |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 597'143 bytes |
| First seen: | 2022-05-05 06:21:09 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 12288:nXRjaEbPENtG7Q4g1wqk0LlhTKf5qX23dfEBZo:X4Est14YafbdR |
| TLSH | T166C423EC0F373F801275EFB57D6C178F1862D60842D896E8B1644B4A0AB29256EDD1FE |
| TrID | 80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1) |
| Reporter |  cocaman |
| Tags: | AgentTesla Shipping zip |
cocaman
Malicious email (T1566.001)From: "Shipping, Shivam<info@shivamshippingagency.com>" (likely spoofed)
Received: "from shivamshippingagency.com (unknown [180.214.238.82]) "
Date: "4 May 2022 15:42:01 -0700"
Subject: "VESSEL STATUS"
Attachment: "SHIPPING ADVICE#202204.zip"
Intelligence
File Origin
# of uploads :
1
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
fareit obfuscated packed
Result
Verdict:
MALICIOUS
Link:
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
Win32.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-05-04 17:37:08 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
22 of 41 (53.66%)
Threat level:
5/5
Detection(s):
Malicious file
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla collection evasion keylogger spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Maps connected drives based on registry
Checks BIOS information in registry
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
AgentTesla Payload
Looks for VirtualBox Guest Additions in registry
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot1562684159:AAF0RHsedAMUFPfvPk6IyrreCEPxQ_b3Y3g/sendDocument
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Dropping
AgentTesla
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.