MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b535df4412e9df0e5e9b1a76f64a2f977ec3ab8a59abcc77dbd95e562012992. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b535df4412e9df0e5e9b1a76f64a2f977ec3ab8a59abcc77dbd95e562012992
SHA3-384 hash: 83032cbdc64f45d5870cd898b12142a610e5eb67de4558412c5dce636299d9f4d297b0c42bd03a1a374c828da18a9c94
SHA1 hash: 2128d01c7e3a073262ea097792a9b2e6ea94673b
MD5 hash: 97ee77d34e27fc891934d0ceda085a29
humanhash: india-florida-high-item
File name:MASTER CONTACT DETAILS.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:426'380 bytes
First seen:2021-06-08 05:26:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:AFWURV2xOzg9E1LT2upkAC+KjRruKVUm9JJ/rZPlsm7jk1lj5u1AJ1PwNZne4:/Orgu1LgaQbVPlVIqux4
TLSH 2C94235A6C1FCE613978A9876BC28E0F0C4C713B255E964A36D7C69E0D8F66F360F421
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "FORTUNE STAR SHIPPING PTE LTD<ops@pgshpg.com>" (likely spoofed)
Received: "from pgshpg.com (unknown [64.44.139.163]) "
Date: "07 Jun 2021 13:13:18 -0700"
Subject: "MV XIN HAI TONG23 - AGENT NOMINATION / PDA REQUEST"
Attachment: "MASTER CONTACT DETAILS.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b535df4412e9df0e5e9b1a76f64a2f977ec3ab8a59abcc77dbd95e562012992/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-07 18:34:13 UTC
File Type:
Binary (Archive)
Extracted files:
58
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tnjv35cbf2o7bzpjwgtw6zfc7f36yovyuwnlzr35xwk6kyqbfgja._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210608-7vbkp7ghja/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot1765743101:AAFjAIqoiFu5pUMytacYpCrgIdiSe6mbRkM/sendDocument
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9b535df4412e9df0e5e9b1a76f64a2f977ec3ab8a59abcc77dbd95e562012992

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 9b535df4412e9df0e5e9b1a76f64a2f977ec3ab8a59abcc77dbd95e562012992

(this sample)

AgentTesla

Executable exe 4b78575b143ad3445c37789bbb9fcfc5d1abf7a788eeb09dd6cee6df3c8984af

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4b78575b143ad3445c37789bbb9fcfc5d1abf7a788eeb09dd6cee6df3c8984af

Comments