MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61b763d5012aee40fea8a17077173a6fbb12ecf8339f9f3d4b5fb3e6f6bea91e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61b763d5012aee40fea8a17077173a6fbb12ecf8339f9f3d4b5fb3e6f6bea91e
SHA3-384 hash: 6bca46d5a61fc90b8596b9dd1e08f8abf1e3499909364c0adb857db94eea1d17d6f9b2c151f9fdcb354ae47d289b94b4
SHA1 hash: 3365b22ce0583252c64ec8d9b10b56ad8d1c3477
MD5 hash: b773f323b3c4305b74b0280d48986735
humanhash: uncle-potato-princess-sad
File name:Released Order.r15
Download: download sample
Signature AgentTesla
Create hunting rule
File size:749'362 bytes
First seen:2021-07-21 15:00:15 UTC
Last seen:2021-07-21 15:01:22 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:5CNCXZNdPvPBFZsS/FfKBK5NbPumb0hagc0pDwJqxcimFbh6MDelttgWMfiS4WgG:OCpDPHBFWyKBK5NypwgfpFTmclttgvfX
TLSH T123F4235F0326BD5117E8551C183C29824FFBF2AA1BDE55048908DDFAFC71EC619BA1E8
Reporter cocaman
Tags:AgentTesla r15 rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Ravi jaitly"<ravijaitly@dcmshriram.com>" (likely spoofed)
Received: "from dcmshriram.com (unknown [45.137.22.75]) "
Date: "21 Jul 2021 16:25:45 +0200"
Subject: "Purchase Order 4110043899"
Attachment: "Released Order.r15"

Intelligence

File Origin
# of uploads :
3
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61b763d5012aee40fea8a17077173a6fbb12ecf8339f9f3d4b5fb3e6f6bea91e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-21 12:49:51 UTC
File Type:
Binary (Archive)
Extracted files:
44
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mg3whvibflxeb7viufyhofz2n65rf3hygopz6pkll6z6n5v6vepa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210721-wf2s3l2yw2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/61b763d5012aee40fea8a17077173a6fbb12ecf8339f9f3d4b5fb3e6f6bea91e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 61b763d5012aee40fea8a17077173a6fbb12ecf8339f9f3d4b5fb3e6f6bea91e

(this sample)

AgentTesla

Executable exe b42810cd608efd9b6058c018518048874d453ed62663f8a1ac2a2c6f2227b0c8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b42810cd608efd9b6058c018518048874d453ed62663f8a1ac2a2c6f2227b0c8
  
Dropping
AgentTesla

Comments