MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64b13fb51affdd02f7313c8125ecffbe689991494702e66c4054efd76d01f35e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64b13fb51affdd02f7313c8125ecffbe689991494702e66c4054efd76d01f35e
SHA3-384 hash: 2b03be67c6738f9c4baa3bc1ca3b76245c41c1bbc0533e93ea49821373c3187b25771c4065ba927425ef41c792607746
SHA1 hash: 93b7d94fbfd9e7be38850c0dcd31503fb9aacbc3
MD5 hash: cf251ae9ee92ea9882ee21de4601b32c
humanhash: ink-whiskey-undress-victor
File name:BID TENDER DOCUMENTS.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:752'624 bytes
First seen:2022-02-11 08:28:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:opDti01wPnaSZOVzLU+VymgG5cfbi+cZYu+Et4286ReK1lfXmN8ew2s:opDrGSrVzFAGd+/6UUPx7
TLSH T1B6F42391CE58B9AADF35C9F7DA1C8001B73814B1B4736D2A3F956BF95BDC13828E4902
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Maria Simao<admin@mokitens.gq>" (likely spoofed)
Received: "from mokitens.gq (unknown [185.222.58.57]) "
Date: "11 Feb 2022 07:00:02 +0100"
Subject: "RE: Project Quotation Request"
Attachment: "BID TENDER DOCUMENTS.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20220211-0103.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
67%
Tags:
cobra obfuscated packed replace.exe strictor update.exe
Link:
https://www.filescan.io/uploads/62061e1a54047500bb3f7133/reports/6cecbcbe-2ca3-402c-8507-25543d4bb1e3/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/64b13fb51affdd02f7313c8125ecffbe689991494702e66c4054efd76d01f35e
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/64b13fb51affdd02f7313c8125ecffbe689991494702e66c4054efd76d01f35e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-10 10:19:33 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
25 of 43 (58.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=msyt7ni277oqf5zrhsasl3h7xzujtekji4bom3caktx5o3ib6npa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220211-kc1v5acdc2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 64b13fb51affdd02f7313c8125ecffbe689991494702e66c4054efd76d01f35e

(this sample)

AgentTesla

Executable exe 152b87fb9a2a89f2cfea3a18c2b69f61b5035eac110ad38d64636f410a1a22d4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 152b87fb9a2a89f2cfea3a18c2b69f61b5035eac110ad38d64636f410a1a22d4
  
Dropping
AgentTesla

Comments