MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8deaa8789f9392ce4fbab6cfbb6598d5c4cd075012b396827103b00958490c9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8deaa8789f9392ce4fbab6cfbb6598d5c4cd075012b396827103b00958490c9a
SHA3-384 hash: 447e57a0151b91201e379465d1db6da6433f02d39d3e1213bd59dcd4e9baf047f694050c7dfaac128ec54b34a6d6a2e3
SHA1 hash: c20da81fa79c099dc9e71d97f29460682ffaff6e
MD5 hash: c2edb5f467db0ac0bf4b40307e36e066
humanhash: uniform-carbon-venus-four
File name:payment advice 0264.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:792'979 bytes
First seen:2021-04-26 12:41:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:LKp+pA2+3pSLS25pk3xJaqGvaNcRkMYeTlW:LKBPSLpYxJGhYSW
TLSH 4DF43367EBBC016F7D12A03874839D075CAE2E1D54686B3BC2B71207C5FA5B0A9B315B
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "trend@latrendexports.com" (likely spoofed)
Received: "from latrendexports.com (unknown [185.222.57.216]) "
Date: "26 Apr 2021 05:03:35 -0700"
Subject: "PAYMENT ADVICE FOR OUTSTANDING SOA,"
Attachment: "payment advice 0264.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8deaa8789f9392ce4fbab6cfbb6598d5c4cd075012b396827103b00958490c9a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-26 09:44:44 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rxvkq6e7sojm4t52w3h3wzmy2xcm2b2qckzznatraoyaswcjbsna._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210426-nmx7fplen6/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8deaa8789f9392ce4fbab6cfbb6598d5c4cd075012b396827103b00958490c9a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 8deaa8789f9392ce4fbab6cfbb6598d5c4cd075012b396827103b00958490c9a

(this sample)

AgentTesla

Executable exe e9342d5c2ca95888a7589ef0fa20636b3534e64a8e7b419e772977c04745dcc7

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e9342d5c2ca95888a7589ef0fa20636b3534e64a8e7b419e772977c04745dcc7
  
Dropping
AgentTesla

Comments