MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 625d77dfe7f5dd78fa40accd4e84a12cb5387e6de68f771d0f138e97a18a2959. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 625d77dfe7f5dd78fa40accd4e84a12cb5387e6de68f771d0f138e97a18a2959
SHA3-384 hash: d448cf9250d3204bd64ec5f75e198e92d86cf452c9c8a14c1b04337a2c768042267a3f4f2eefc0295bb6347d207bc87d
SHA1 hash: 3b737760a8814fc55b9fd0169424be755cbc8a03
MD5 hash: 520491b040ed3fdea7a877acee2f9ca1
humanhash: cardinal-nineteen-nitrogen-hot
File name:Po docs. pdf...............................r16
Download: download sample
Signature AgentTesla
Create hunting rule
File size:471'549 bytes
First seen:2021-12-03 08:43:25 UTC
Last seen:2021-12-04 01:06:47 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:mOxAagXvNMuC43XM0eCa0YAJ7hOrCgKO1OlYcL7yWuGHTX:vFYyT4Te/0iFxOlYu7yWbHT
TLSH T107A423F7B4243EFA7155077CDE4230D1BEEB45CBECA1ABB0604D57C291888B56289E49
Reporter cocaman
Tags:r16 rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Robert Chen" <omn_dkpb_ns@emer.kz>" (likely spoofed)
Received: "from emer.kz (unknown [202.55.135.222]) "
Date: "2 Dec 2021 20:43:42 -0800"
Subject: "Purchase order"
Attachment: "Po docs. pdf...............................r16"

Intelligence

File Origin
# of uploads :
3
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27121.RarHeur.NoDP.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
black fareit greyware obfuscated packed
Link:
https://www.filescan.io/uploads/61a9d8d5fa72c81b5b0918b6/reports/e4f50dc5-5ed0-496b-98e3-cf3263524e55/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/625d77dfe7f5dd78fa40accd4e84a12cb5387e6de68f771d0f138e97a18a2959/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-30 17:18:00 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
27 of 45 (60.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mjoxpx7h6xoxr6savtgu5bfbfs2tq7tn42hxohipcohjpimkffmq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/211203-km6jcsagg7/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/625d77dfe7f5dd78fa40accd4e84a12cb5387e6de68f771d0f138e97a18a2959

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 625d77dfe7f5dd78fa40accd4e84a12cb5387e6de68f771d0f138e97a18a2959

(this sample)

AgentTesla

Executable exe a2a9b6a0deb3f24e5239a84442bdf3e0d45f2c19b2c1ceb0a1c32f37d38b7a54

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a2a9b6a0deb3f24e5239a84442bdf3e0d45f2c19b2c1ceb0a1c32f37d38b7a54

Comments