MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87ca7338102b585ba5eef4bd89fb2d24dbce8c7b57ae4d62fd3b7e29988b5e65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87ca7338102b585ba5eef4bd89fb2d24dbce8c7b57ae4d62fd3b7e29988b5e65
SHA3-384 hash: f144662e3fe598bfe34759282fd56a7db1115ac529e458ae5473c196034c7aa42896bdc3188e00b0ed6cfbc76c724e8f
SHA1 hash: 99536fe4ebcfc41ba83472c0f5f7a0a57e6de849
MD5 hash: 4a0bdac5e05f41ae7c96f626381aedd7
humanhash: emma-lima-don-river
File name:OUTSTANDING INVOICE-CONSIGN GLOBAL LOGISTICS.xsl.exe.gz.001
Download: download sample
Signature AgentTesla
Create hunting rule
File size:713'349 bytes
First seen:2023-12-18 06:36:03 UTC
Last seen:2023-12-18 14:13:43 UTC
File type: gz
MIME type:application/gzip
ssdeep 12288:W/1v2ElbBFaqFFinQl4VTb5WHQ62J2pW1r461G+OLhopsS2gidtIZz6blSlj0t8O:W/1v2EjFDFFinI4tb56n23r4C+FoeS2R
TLSH T1B4E4339D1282F80B466BA1D371ADA3AE3C6ED1581910F7AB3AAD731763055DEE033D34
Reporter cocaman
Tags:001 AgentTesla gz INVOICE


Avatar
cocaman
Malicious email (T1566.001)
From: ""PRICING" <pricing@consignglobal.com>" (likely spoofed)
Received: "from consignglobal.com (unknown [45.137.22.230]) "
Date: "17 Dec 2023 21:31:27 +0100"
Subject: "URGENT!!! OUTSTANDING INVOICE LIST OF CONSIGN GLOBAL LOGISTICS"
Attachment: "OUTSTANDING INVOICE-CONSIGN GLOBAL LOGISTICS.xsl.exe.gz.001"

Intelligence

File Origin
# of uploads :
2
# of downloads :
123
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:OUTSTANDING INVOICE-CONSIGN GLOBAL LOGISTICS.xsl.exe
File size:905'216 bytes
SHA256 hash: 0390ab5a06e04c8c38776aeeea11fd0352230d049be1defb139e71e8906114ba
MD5 hash: 54679e8d61d8b6504a9d91e0bc618aa7
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.MulDrop24.34313.137.6868.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/657fe88ff4b6e5e1634e885a/reports/8a06b614-1339-4013-91e3-1aa387883cd5/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/87ca7338102b585ba5eef4bd89fb2d24dbce8c7b57ae4d62fd3b7e29988b5e65
Result
Verdict:
MALICIOUS
Score:
100%
Verdict:
Malware
File Type:
Archive
Link:
https://malprob.io/report/87ca7338102b585ba5eef4bd89fb2d24dbce8c7b57ae4d62fd3b7e29988b5e65
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87ca7338102b585ba5eef4bd89fb2d24dbce8c7b57ae4d62fd3b7e29988b5e65/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-12-17 15:44:02 UTC
File Type:
Binary (Archive)
Extracted files:
42
AV detection:
23 of 37 (62.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q7fhgoaqfnmfxjpo6s6yt6znetn45dd3k6xe2yx5hn7ctgellzsq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/231218-h28adsahc5/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Checks computer location settings
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/87ca7338102b585ba5eef4bd89fb2d24dbce8c7b57ae4d62fd3b7e29988b5e65

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 87ca7338102b585ba5eef4bd89fb2d24dbce8c7b57ae4d62fd3b7e29988b5e65

(this sample)

AgentTesla

Executable exe 0390ab5a06e04c8c38776aeeea11fd0352230d049be1defb139e71e8906114ba

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0390ab5a06e04c8c38776aeeea11fd0352230d049be1defb139e71e8906114ba
  
Dropping
AgentTesla

Comments