MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 702ec70acfcb060db7d7a722325ccb32fc3e31ec1189290a73fdacbcd378fc80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 702ec70acfcb060db7d7a722325ccb32fc3e31ec1189290a73fdacbcd378fc80
SHA3-384 hash: ab65e3f155b1418d905c04041c47cbda8cbc04a6b0f9aa4dfd575c2fe9e2e2b800ab16e930f178ea6f2bafdfe93331e6
SHA1 hash: e05d49daf0a86f41d473e2c20671f22d2f9e347b
MD5 hash: 52136188e9782619de2c7c5b8d3cf919
humanhash: nineteen-king-one-floor
File name:payment advice.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:594'231 bytes
First seen:2022-02-03 07:59:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:fbwKZfdjJxivm3Q2Xe0T2m+lx/cCW78/joHBYTdeqMqb2Tmn+5Q6mLvWXxjV5b3w:TLZhOvBc96xQ78/joH4oqWTm+5PmLWXC
TLSH T1A8C4232EDF0080FABE9BE9D866646FE44577401147109B79F89FE95B8725C33AF2C211
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "accountspayable@hindoffshore.com" (likely spoofed)
Received: "from hindoffshore.com (unknown [185.222.58.50]) "
Date: "03 Feb 2022 04:05:44 +0100"
Subject: "Inward Remittance - Smit Salvage - USD 69,000/-"
Attachment: "payment advice.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs812.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61fb8b936d25ac9e790155e9/reports/d6401f36-9111-43f7-aeb6-d7c3e4b12c25/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/702ec70acfcb060db7d7a722325ccb32fc3e31ec1189290a73fdacbcd378fc80
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/702ec70acfcb060db7d7a722325ccb32fc3e31ec1189290a73fdacbcd378fc80/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-03 01:03:38 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
22 of 43 (51.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oaxmocwpzmda3n6xu4rdexglgl6d4mpmcgessctt7wwlzu3y7saa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220203-jv21gaedek/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/702ec70acfcb060db7d7a722325ccb32fc3e31ec1189290a73fdacbcd378fc80

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 702ec70acfcb060db7d7a722325ccb32fc3e31ec1189290a73fdacbcd378fc80

(this sample)

AgentTesla

Executable exe 1c88e64fa65839e26939ab7701755252b7f24b8e65164dd88acae735c30e4fc4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1c88e64fa65839e26939ab7701755252b7f24b8e65164dd88acae735c30e4fc4

Comments