MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ade41652594c97defe631b9312e5c01b6d84c37c6be804524d91742bfd087a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ade41652594c97defe631b9312e5c01b6d84c37c6be804524d91742bfd087a7
SHA3-384 hash: 43d0e36ca7236ec46b04d9853eac7d2694e9c49a7eb69a37a4f6f54e80e7babf33a6e6a10c12eeb829c10d0d9258a2e0
SHA1 hash: ad193d154bbafe6bc4d322b33f45b3cb0db721ab
MD5 hash: be43ed9cede979760f1b3b6468b3566c
humanhash: ink-seventeen-oscar-uniform
File name:Purchase Order from Aeon Viet Nam.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:268'671 bytes
First seen:2021-04-19 16:49:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:4bxxQmKxRg8WoNC5zk8n2FMn0+w3Lp2bII9d/rdg:44G8T2v26/yF2bP9ldg
TLSH C04423F32F2928AD3AD5E533DD31E30DB915D4E85DB04D4A8BD14894078CAC9DCCA9B6
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/9ade41652594c97defe631b9312e5c01b6d84c37c6be804524d91742bfd087a7
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9ade41652594c97defe631b9312e5c01b6d84c37c6be804524d91742bfd087a7/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tlpeczjfstex337ggg4tcls4ag3nqtbxy27iarje3elufp6qq6tq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210419-za9mvt2gy6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.72
Link:
https://yomi.yoroi.company/submissions/9ade41652594c97defe631b9312e5c01b6d84c37c6be804524d91742bfd087a7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9ade41652594c97defe631b9312e5c01b6d84c37c6be804524d91742bfd087a7

(this sample)

AgentTesla

Executable exe fef5e611f4e7df41a0de6373c01e61810f8c8778ab47225cba04fdc7eb2641ee

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fef5e611f4e7df41a0de6373c01e61810f8c8778ab47225cba04fdc7eb2641ee
  
Dropping
MD5 354e8e03c8f44e6d33b29bf19869868f

Comments