MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f22091e006aab35e3021487b1a7a3bd2584cb38bdf737fe5cfcfb7a58f5fccf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f22091e006aab35e3021487b1a7a3bd2584cb38bdf737fe5cfcfb7a58f5fccf
SHA3-384 hash: 8c4e690a6a9ddbe4ad3b5d7606f679ab4f71c9147dd67401cdc94dddfdf6eae8baa13adbf9a2f99405b7cf3f55f7573b
SHA1 hash: fd7ae21a6451d53e295b0f04abb77c5057f67d87
MD5 hash: 29abb3040e010e2600fadc73675c0491
humanhash: hot-lion-speaker-salami
File name:No.Order 8200004038.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:650'028 bytes
First seen:2021-12-02 13:56:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:en8U4y2e5vUFYG38DZ1aCXzx+o4pGPcinq+SoMf8GxPSUgUxi9o/oae:edtvUaGs+Cjxl4pqciq4A1JS3Uql
TLSH T13DD423595FBCB32BE1B0BF1696F54B68B0B4A719DE4E1AE316006BC202D7C8D3E58117
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "sales@ge-industry.com" (likely spoofed)
Received: "from ge-industry.com (unknown [104.223.42.165]) "
Date: "02 Dec 2021 02:50:52 -0800"
Subject: "RE:_Reply:_RE_:_RFQ_No.Order 8200004038_DAIDO-2021-QPE-Q63440093-0001_//_A-5555-1239_&_A-5004-0808"
Attachment: "No.Order 8200004038.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61a8d0b186bf67e7121fedfb/reports/4ae530c0-2176-4769-a8cc-e9cf6ccb3e4a/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f22091e006aab35e3021487b1a7a3bd2584cb38bdf737fe5cfcfb7a58f5fccf/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-12-02 13:57:12 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
17 of 45 (37.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t4rashqankvtlyyccsd3dj5dxusyjszyxx3tp7s47t5xuwhv7thq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/211202-q89qsscdg6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5074572303:AAE8ZKRzrDBFdUptPX0s5TohA3XJtaS_H_8/sendDocument
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9f22091e006aab35e3021487b1a7a3bd2584cb38bdf737fe5cfcfb7a58f5fccf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 9f22091e006aab35e3021487b1a7a3bd2584cb38bdf737fe5cfcfb7a58f5fccf

(this sample)

AgentTesla

Executable exe b8baaf727f8da89fe81122fd5c93c3d34b7f3f78ae90403309d7d335e0bb3792

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b8baaf727f8da89fe81122fd5c93c3d34b7f3f78ae90403309d7d335e0bb3792

Comments