MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73f765a9c4713b8047fe5f71e0bd38426f230df062b6e291990dffe6e0836ba8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73f765a9c4713b8047fe5f71e0bd38426f230df062b6e291990dffe6e0836ba8
SHA3-384 hash: 491d15c9bcf39731d417d408c528b15e8c70211d0009b5e31e0edf3133b0710ba5be45f93978881d1cb1ab4b41a2ef07
SHA1 hash: 41a5f774a8e613f19119e9515bfb8fc021ddde9f
MD5 hash: 6487f113dda7b69b9404d218d525fbf2
humanhash: fish-pizza-black-crazy
File name:BL.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:668'352 bytes
First seen:2021-05-08 05:21:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:BxQLmf01lxx9JISwq0LCrfgIj/8uVISyQlfImQlL1pBQbxJbVewK0jGYXFWEz:fQLoWxx3prfB8ueSxbw7ObUMT1WS
TLSH B0E433681D216D8D4F873B3DF8BB264227197D16E9B2160B25C130DEDA2C41E728E7ED
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Sofien Ben Jemaa<info@probona.com.tr>" (likely spoofed)
Received: "from probona.com.tr (unknown [103.133.106.100]) "
Date: "7 May 2021 13:06:47 -0700"
Subject: "Original Documents"
Attachment: "BL.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.624-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/73f765a9c4713b8047fe5f71e0bd38426f230df062b6e291990dffe6e0836ba8
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/73f765a9c4713b8047fe5f71e0bd38426f230df062b6e291990dffe6e0836ba8/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-05-08 05:21:18 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=op3wlkoeoe5yar76l5y6bpjyijxsgdpqmk3ofemzbx76nyednoua._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210508-esxamve5ej/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/73f765a9c4713b8047fe5f71e0bd38426f230df062b6e291990dffe6e0836ba8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 73f765a9c4713b8047fe5f71e0bd38426f230df062b6e291990dffe6e0836ba8

(this sample)

AgentTesla

Executable exe 76184a1554ddbb339b8df5b47538c78621c515fd4825302f94879f781148db4c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 76184a1554ddbb339b8df5b47538c78621c515fd4825302f94879f781148db4c

Comments