MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77e08d7f47f9584074e5f8dfec1ed1c2d425c463fd6a2632842c30ef7a582e69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77e08d7f47f9584074e5f8dfec1ed1c2d425c463fd6a2632842c30ef7a582e69
SHA3-384 hash: 9432694f22c460deee03d01b80a1fc9153ccde4ef7edb7d32baa5280a4c40fcb3749787feb2f9c078e803141e2e37164
SHA1 hash: aa6a2b214d2c9678c8c53c4c42771e42fcb46cd7
MD5 hash: 91a3edfa1259b5659c746855120abfc8
humanhash: seventeen-grey-stream-batman
File name:RECIP008000879.PDF....UUE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:648'040 bytes
First seen:2021-03-26 06:45:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:7/SOA4vwxMCTd7ubTpLkgkpOjmFwFCqcxUATR9gPAeOymqSI69AJBPMMfhbz+x10:7/SOh8nd7qpQgkLwmxUAPql1j7tSxi
TLSH 71D4332D296FA6048FBA9B4831E9D0123DF14D9ADC3C485C161CCAFEEC9B5938C72D95
Reporter cocaman
Tags:uue


Avatar
cocaman
Malicious email (T1566.001)
From: "nesrin-bulbul@hotmail.com" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.107]) "
Date: "26 Mar 2021 04:41:27 -0700"
Subject: "=?UTF-8?B?5Y+R56WoODkzNDU0?="
Attachment: "RECIP008000879.PDF....UUE"

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.30666.5789.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Mal.Generic-S.29994.9463.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Win32.Save.a.6791.12863.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/77e08d7f47f9584074e5f8dfec1ed1c2d425c463fd6a2632842c30ef7a582e69
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/77e08d7f47f9584074e5f8dfec1ed1c2d425c463fd6a2632842c30ef7a582e69/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-26 06:45:09 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/77e08d7f47f9584074e5f8dfec1ed1c2d425c463fd6a2632842c30ef7a582e69

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 77e08d7f47f9584074e5f8dfec1ed1c2d425c463fd6a2632842c30ef7a582e69

(this sample)

AgentTesla

Executable exe 81453065bd00296f689d548aba1571a2fae836d7708089a46c62a0045ff1baa6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 81453065bd00296f689d548aba1571a2fae836d7708089a46c62a0045ff1baa6
  
Dropping
SHA256 d52fe7af7f5d3a031f670ada720d9d1f9d451a096ce46862e589fb30af397cee
  
Dropping
SHA256 a5b12e2ac3b1a01783989acfe7e00c29dd53fa953f88963b9207b38a3f5b4547

Comments