MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ff203c1fe2e11952de2655d7e830a1d59b87ceedc39cfe6fe2420be49f99bae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ff203c1fe2e11952de2655d7e830a1d59b87ceedc39cfe6fe2420be49f99bae
SHA3-384 hash: d7ea994f24c063225693dd61fe61fd6712d39723bc166c2638f7504ad2942c55600e508a627e4fc7d799407e907ac3df
SHA1 hash: f7949792483bbd1d910894d9e3b2b2653f0b9553
MD5 hash: 86492f609c56774ba638f7d69783a3c2
humanhash: xray-butter-salami-september
File name:RFQ 18757_Pdf_________.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'253'376 bytes
First seen:2021-07-01 10:25:12 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:GmhzhKWZXXiNSVCPFMMVjR4bkzVLa4hx:ZhzhvZXXdArjR4ozVLph
TLSH C645D00BF6099B41C8541238CCEFC2741375ED9A78238B1B3A9D7AED3DB3621CD556A8
Reporter cocaman
Tags:AgentTesla iso


Avatar
cocaman
Malicious email (T1566.001)
From: "Ibrahim BA Hashwan <sarstedt@teosat.pl>" (likely spoofed)
Received: "from teosat.pl (unknown [185.222.57.233]) "
Date: "1 Jul 2021 12:23:45 +0200"
Subject: "Urgent Tender RFQ 18757 FOR CPUW-1022601"
Attachment: "RFQ 18757_Pdf_________.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1133.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9ff203c1fe2e11952de2655d7e830a1d59b87ceedc39cfe6fe2420be49f99bae/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-07-01 07:21:56 UTC
File Type:
Binary (Archive)
Extracted files:
52
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t7zahqp6fyizklpcmvox5aykdvm3q7ho3q447zx6eqql4spztoxa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210701-tsvf99x65n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9ff203c1fe2e11952de2655d7e830a1d59b87ceedc39cfe6fe2420be49f99bae

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 9ff203c1fe2e11952de2655d7e830a1d59b87ceedc39cfe6fe2420be49f99bae

(this sample)

AgentTesla

Executable exe 46f0e45dbbf592ca7ed929b193254ece1cc22c3719888b8aafc32685dcd64f5e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 46f0e45dbbf592ca7ed929b193254ece1cc22c3719888b8aafc32685dcd64f5e
  
Dropping
AgentTesla

Comments