MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8443617bdd1e72b42f27753a87773d48df8ccf5c8084d4a56d016c197ac3f09e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8443617bdd1e72b42f27753a87773d48df8ccf5c8084d4a56d016c197ac3f09e
SHA3-384 hash: 92d0ffa878a1f3f661edc7a489cd79d8d23ab0907b3e6cb38fc2b422b399107c8ebfb68237f44e0b23dc69ea13d9b48b
SHA1 hash: 6c3d3253a1f5a7e7486550b3653714934008457b
MD5 hash: e6c764dc2b91503d17190b70dd1bede9
humanhash: table-seven-quebec-solar
File name:NEW ORDER.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:488'073 bytes
First seen:2022-06-30 07:23:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Ehscu6MSA0yhg+L7v9XG6vbdF3FVG1aEe5vKvme90I1jMlzeFzt:EhnpKFL7FW6BF3FVGHvx9Vtzt
TLSH T132A423FE66EA20651E408C1CD79301916F4BC0AF55E4CED6A03F29B77350D89EA4F1B9
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "<weikeltpe@ornament.com.tw>" (likely spoofed)
Received: "from ornament.com.tw (unknown [185.222.57.86]) "
Date: "29 Jun 2022 15:56:19 +0200"
Subject: "RE: THE NEW ORDER FOR FU#F211213-016(OR22078)"
Attachment: "NEW ORDER.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
175
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62bd4fd01756f979fbcbb893/reports/e61338c5-f325-4b42-900f-4aad6995c141/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/8443617bdd1e72b42f27753a87773d48df8ccf5c8084d4a56d016c197ac3f09e
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8443617bdd1e72b42f27753a87773d48df8ccf5c8084d4a56d016c197ac3f09e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-29 04:12:18 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qrbwc665dzzlilzhou5io5z5jdpyzt24qccnjjlnafwbs6wd6cpa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer suricata trojan
Link:
https://tria.ge/reports/220630-h8c3tsgghl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
AgentTesla
suricata: ET MALWARE AgentTesla Exfil Via SMTP
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8443617bdd1e72b42f27753a87773d48df8ccf5c8084d4a56d016c197ac3f09e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 8443617bdd1e72b42f27753a87773d48df8ccf5c8084d4a56d016c197ac3f09e

(this sample)

AgentTesla

Executable exe 24a12030fa4b7c7e61ccc5d9f1f4e7de90df94d1bb5af50f5885a86c9e384010

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 24a12030fa4b7c7e61ccc5d9f1f4e7de90df94d1bb5af50f5885a86c9e384010
  
Dropping
AgentTesla

Comments