MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9fb53efacb972ea3da3460f7985174efc41d3b8e2f4527aecc57c0404bf4e27e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9fb53efacb972ea3da3460f7985174efc41d3b8e2f4527aecc57c0404bf4e27e
SHA3-384 hash: 598cb05b689a867d7a389388ad73ca16dc87e26fbe4364583efe1b18768bafc6d8c54d9e47d2ee9250b00b1890135e55
SHA1 hash: 282c9be9de4ced8922d2e5e784784fe0ad61dc9b
MD5 hash: ca2187e6243fb81d0961a7cf0904ecaf
humanhash: enemy-comet-mobile-east
File name:_Purchase Order copy.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'049'638 bytes
First seen:2021-04-23 10:20:54 UTC
Last seen:2021-04-23 13:06:37 UTC
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 24576:Q54jedF+eB+HZC18qaOFqvtCgG7Aoh2497wj3AmGcng9n:nedF+dH818LOFqARcoh2Kcj3Ambnq
TLSH 6B2533311437BB24EE93D07B17A1F8A13FF2A1B0921626F79A842DD9F71694A340647F
Reporter GovCERT_CH

Intelligence

File Origin
# of uploads :
2
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.678.29781.4144.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9fb53efacb972ea3da3460f7985174efc41d3b8e2f4527aecc57c0404bf4e27e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-23 01:20:17 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t62t56wls4xkhwrumd3zqulu57cb2o4of5csplwmk7aeas7u4j7a._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210423-6hkg87sxma/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9fb53efacb972ea3da3460f7985174efc41d3b8e2f4527aecc57c0404bf4e27e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 9fb53efacb972ea3da3460f7985174efc41d3b8e2f4527aecc57c0404bf4e27e

(this sample)

AgentTesla

Executable exe 71e6c949b0e259018b39ad513305c9197afe74c9d68119db8e6e545c74ceedcb

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 71e6c949b0e259018b39ad513305c9197afe74c9d68119db8e6e545c74ceedcb
  
Dropping
MD5 1f78302367062565a269db810ef754c2

Comments