MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98ec0a49ce8bb1fa047da66fc023332321bae4c11a2b472b99d9bb78becb6df2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98ec0a49ce8bb1fa047da66fc023332321bae4c11a2b472b99d9bb78becb6df2
SHA3-384 hash: 6cdc43ddc73e515d921741c30810a8055f0acb4fdbedc9bb1a28ffa80536ae10c1ac2c730d1d7e51bb5dedc2cd700fb3
SHA1 hash: 41d112788e632c7841b9817e9e8e86c215db0b53
MD5 hash: ab316dcda907f92d689924053881b05c
humanhash: echo-fifteen-twenty-jersey
File name:shipping�invoice.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:642'339 bytes
First seen:2021-06-18 05:41:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:B6sVoEKtN5OJ0VT369OkxQlieJ1Ryd18rNb3Bbkp1wkoPu3xd:AN5OJI36UlieHRVXQ1wkn
TLSH 91D4335989E116BADC777A13994F0CE022250D22D7386572497448B2ED734F3AE3FE2B
Reporter cocaman
Tags:INVOICE zip


Avatar
cocaman
Malicious email (T1566.001)
From: "mohammed.ali@algharshobgroup.com" (likely spoofed)
Received: "from algharshobgroup.com (unknown [45.137.22.38]) "
Date: "17 Jun 2021 08:13:28 -0700"
Subject: "RE: Flight Details With Shipping Invoice"
Attachment: "shipping�invoice.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_hidden.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Rogue.0hr.20210617-1605.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/98ec0a49ce8bb1fa047da66fc023332321bae4c11a2b472b99d9bb78becb6df2
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98ec0a49ce8bb1fa047da66fc023332321bae4c11a2b472b99d9bb78becb6df2/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-06-17 16:23:59 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
10 of 29 (34.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tdwausooroy7ubd5uzx4aiztemq3vzgbdivuok4z3g5xrpwlnxza._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210618-1eg6ztcx2x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/98ec0a49ce8bb1fa047da66fc023332321bae4c11a2b472b99d9bb78becb6df2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 98ec0a49ce8bb1fa047da66fc023332321bae4c11a2b472b99d9bb78becb6df2

(this sample)

AgentTesla

Executable exe 000f72da09396d3bf401f056b888a2c5d2b9e485bde07cceffb272c78ca973e1

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 000f72da09396d3bf401f056b888a2c5d2b9e485bde07cceffb272c78ca973e1

Comments