MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9baa0da769d40eb2b41b528d6beff487c7603be46d81ad11454ae556169adf99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9baa0da769d40eb2b41b528d6beff487c7603be46d81ad11454ae556169adf99
SHA3-384 hash: 0e0f64edf5426494401701d38f8f88f7ed8eeeeef0f9510971c3777c0cf662b8fe9ea5b8eaf3ee35ec86aa590e56e94a
SHA1 hash: 19386e1c3c085758616269b59efb0f45336d6222
MD5 hash: af19a172b75952c8a26ebd79afff620e
humanhash: nevada-may-cola-lamp
File name:Drawings_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:609'966 bytes
First seen:2021-04-19 07:31:58 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:ykKUkHqikNtpXxyyjIgQrUWIAV1rxgK73iEhyDvjhXW1SYOf3QLxxdIwNVJU+6h:yaCqPj4ZI0gKDhqvjhXWoDxwrg
TLSH F2D4237406942D42A3519FA38E6BAE22314EC57F6E623054BFC7AEB51E2748C7C3C946
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: ""Joyce Du" < joyce@transtonetire.com>" (likely spoofed)
Received: "from transtonetire.com (unknown [103.99.1.147]) "
Date: "19 Apr 2021 00:30:12 -0700"
Subject: "WT Flange RFQ"
Attachment: "Drawings_pdf.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9baa0da769d40eb2b41b528d6beff487c7603be46d81ad11454ae556169adf99/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tova3j3j2qhlfna3kkgwx37uq7dwao7enwa22ekfjlsvmfu236mq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210419-fz7864t4ds/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9baa0da769d40eb2b41b528d6beff487c7603be46d81ad11454ae556169adf99

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 9baa0da769d40eb2b41b528d6beff487c7603be46d81ad11454ae556169adf99

(this sample)

AgentTesla

Executable exe 22e3af3f64dbc6b64b2f47400be374dcf65bc990ac06bb2e7f77dbe1f61d922d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 22e3af3f64dbc6b64b2f47400be374dcf65bc990ac06bb2e7f77dbe1f61d922d
  
Dropping
AgentTesla

Comments