MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99fb89b43071f1c2b60514298ac2f28c27de776ea1bc0a2956304d83481daa81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 99fb89b43071f1c2b60514298ac2f28c27de776ea1bc0a2956304d83481daa81
SHA3-384 hash: e28963a59ce8afaf4e00591049d8c9708c9f91aa498671d6803c777037bb5e2dcd082fadfe30e82e3be58656b3d6c764
SHA1 hash: 16ebde8f93a5c9372e3a519f880dbc27d821e19f
MD5 hash: fbbad25e8d851e2d3ab09ba868c5d190
humanhash: crazy-red-thirteen-summer
File name:Orders.mn.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:14'094 bytes
First seen:2021-04-19 15:05:20 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:P9KVT0nR8cGosAGcG+/BT8Q8nHjo17uSu:PymR/gAm+ZglHSc
TLSH FC52E0873FC9DE84B0193E340A408AA9277A50C0ADF8257CE77CCA2AE0496333C0759D
Reporter GovCERT_CH

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2008.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/99fb89b43071f1c2b60514298ac2f28c27de776ea1bc0a2956304d83481daa81
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/99fb89b43071f1c2b60514298ac2f28c27de776ea1bc0a2956304d83481daa81/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=th5ytnbqohy4fnqfcquyvqxsrqt5453oug6aukkwgbgygsa5vkaq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210419-nhbfa5gt6a/
Behaviour
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/99fb89b43071f1c2b60514298ac2f28c27de776ea1bc0a2956304d83481daa81

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 99fb89b43071f1c2b60514298ac2f28c27de776ea1bc0a2956304d83481daa81

(this sample)

AgentTesla

Executable exe 07ec2c9cdd71be2769952cb169ec7db7625ba8790d95cf3d977b9544d8efbcf9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 07ec2c9cdd71be2769952cb169ec7db7625ba8790d95cf3d977b9544d8efbcf9
  
Dropping
MD5 74f25f624f40c12bf270ec8c79c042af

Comments