MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fa3827e99f28c847cee92b9753e5978069868f9d7fc447c846bfbeafae43666. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fa3827e99f28c847cee92b9753e5978069868f9d7fc447c846bfbeafae43666
SHA3-384 hash: 88f913b2c1a543dfc46d7c6947c3ee746d33cbdfb844c94d8151b93fbde8acea9a029a23eb7b295f88642c08807ee672
SHA1 hash: 8df8bf19383a03159f378bbac810f11bbefe8957
MD5 hash: 3402fa1649793be014907c9e7538cb90
humanhash: fifteen-stairway-burger-pizza
File name:DUE INVOICES.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:579'800 bytes
First seen:2021-04-29 06:27:34 UTC
Last seen:2021-04-29 10:39:43 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:Q4AMQWIJGfNOI3oHsGfTAxEa4x2X5+dZ2RScgmH0fmw7Nbctt:9A1WIJGfpYMG2F4x2sdoRSj00uw7N+t
TLSH BCC42366E82E14E94C2AEDE43FB784433FA9BA6210D8917D4EB0FE05D4D2508F4B5778
Reporter cocaman
Tags:AgentTesla INVOICE zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""Account" <inginer@ecolux.md>" (likely spoofed)
Received: "from ecolux.md (unknown [185.222.58.152]) "
Date: "28 Apr 2021 21:58:32 -0700"
Subject: "Statement of account -invoices No. 10132870"
Attachment: "DUE INVOICES.zip"

Intelligence

File Origin
# of uploads :
4
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn25.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.688-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/7fa3827e99f28c847cee92b9753e5978069868f9d7fc447c846bfbeafae43666
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7fa3827e99f28c847cee92b9753e5978069868f9d7fc447c846bfbeafae43666/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-29 01:13:15 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
11 of 47 (23.40%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p6rye7uz6kgii7hosk4xkpszpadjq2hz276ei7eenp56v6xegzta._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210429-7h75pvqpz2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7fa3827e99f28c847cee92b9753e5978069868f9d7fc447c846bfbeafae43666

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7fa3827e99f28c847cee92b9753e5978069868f9d7fc447c846bfbeafae43666

(this sample)

AgentTesla

Executable exe 1a5ab3fc479d127e6d2fc01ee7e6eaa2a76a682068e0e84f00edbaab2c77598c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1a5ab3fc479d127e6d2fc01ee7e6eaa2a76a682068e0e84f00edbaab2c77598c
  
Dropping
AgentTesla

Comments