MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7aeab882ca608569e540bbe1bfe252cedab140b11e364c903a74f9de9249a766. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7aeab882ca608569e540bbe1bfe252cedab140b11e364c903a74f9de9249a766
SHA3-384 hash: 235e0dc1b19eea58f2dd28277e42dd98c722c3305ac20da301a3fd8059332a3929958f67ef791ce3a683e47f1bd5e0d5
SHA1 hash: 79553f4ad2e79787f3305d0568b903431cd80206
MD5 hash: 284dd1c9fb125996740ecc4b22e60ace
humanhash: vermont-emma-jupiter-kitten
File name:PI.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:543'866 bytes
First seen:2021-05-05 05:25:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:xUY6CmLrorfV7IrmaNuuyYrFR5B3WDEzOfjt5/Lo9PZ:x9lmLMrfV7IrmaNudkX3mQSfjLLuZ
TLSH 6BC423DA2835A421F51AEDA0E49D7FD84CDE118D828D2B9F0A3DD774D292806CB3D78C
Reporter cocaman
Tags:INVOICE zip


Avatar
cocaman
Malicious email (T1566.001)
From: "sales@covein.com" (likely spoofed)
Received: "from covein.com (unknown [185.222.57.229]) "
Date: "04 May 2021 10:03:36 -0700"
Subject: "RE: Confirm revised invoice to proceed with payment ASAP"
Attachment: "PI.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.624-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21109.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/7aeab882ca608569e540bbe1bfe252cedab140b11e364c903a74f9de9249a766
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7aeab882ca608569e540bbe1bfe252cedab140b11e364c903a74f9de9249a766/
Threat name:
ByteCode-MSIL.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2021-05-04 13:55:50 UTC
File Type:
Binary (Archive)
Extracted files:
32
AV detection:
7 of 47 (14.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=plvlrawkmccwtzkaxpq37yssz3nlcqfrdy3ezeb2ot455esju5ta._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210505-pjkmlspp1e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7aeab882ca608569e540bbe1bfe252cedab140b11e364c903a74f9de9249a766

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7aeab882ca608569e540bbe1bfe252cedab140b11e364c903a74f9de9249a766

(this sample)

AgentTesla

Executable exe b9765f066a8b27b879502a17ea3f305cb41ba31e615e877b8e8966e3c788d3b4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b9765f066a8b27b879502a17ea3f305cb41ba31e615e877b8e8966e3c788d3b4

Comments