MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92f252cae17bd30a46a9884d4d7809d668adf7c403676b048aa3cbe92b747892. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92f252cae17bd30a46a9884d4d7809d668adf7c403676b048aa3cbe92b747892
SHA3-384 hash: 4a45391eec68918057939c82581324124cbd56dfcc851542222f2a0282c0f7f31ef847c9cf016ad713be4d0ff2da5967
SHA1 hash: bd9fd72597d21ede06ccb0e897620fa7289b007e
MD5 hash: b78d159168de623a73b13b1d024be257
humanhash: robin-saturn-yellow-sad
File name:_order 20210407DTR001.IMG.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:14'329 bytes
First seen:2021-04-21 14:42:29 UTC
Last seen:2021-04-23 15:55:29 UTC
File type: zip
MIME type:application/zip
ssdeep 384:E22h4V0PLooL9bS2WCrEvDDADQBKhc4BNLYn:Q+q22tkDs8Ihc4B4
TLSH BE52CF23A09D832F12E0E7311C57DF8C98F6666045EC9A3A05F1892ACD5DB6E139F758
Reporter GovCERT_CH

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2008.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25650.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/92f252cae17bd30a46a9884d4d7809d668adf7c403676b048aa3cbe92b747892
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/92f252cae17bd30a46a9884d4d7809d668adf7c403676b048aa3cbe92b747892/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-21 09:15:21 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=slzffsxbppjqurvjrbgu26aj2zuk356eantwwbekupf6sk3upcja._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210421-498rf3fzns/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/92f252cae17bd30a46a9884d4d7809d668adf7c403676b048aa3cbe92b747892

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 92f252cae17bd30a46a9884d4d7809d668adf7c403676b048aa3cbe92b747892

(this sample)

AgentTesla

Executable exe 5a3479c05afb8620c7e078f550e924d29058c0c14010296f735ac19df393b713

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5a3479c05afb8620c7e078f550e924d29058c0c14010296f735ac19df393b713
  
Dropping
MD5 75c5c3a4a631bd4a8ca1f3b01b959a10

Comments