MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a30d10b1377c33016df61636566a6a95c611f1fe44321eb29bfccc88e8516fca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a30d10b1377c33016df61636566a6a95c611f1fe44321eb29bfccc88e8516fca
SHA3-384 hash: 3523613d9ed55db86f2c58a990f3fbd8cb14c9a79635f42bc613bb99b5fe0137baf03700b4f6944bea55855c50cc1d49
SHA1 hash: 9f9299952f703c20cd0203958e41c7392cafe5e8
MD5 hash: 5b4e3776006492bc8b875ec985aaef61
humanhash: lamp-leopard-alanine-enemy
File name:Docs.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:506'230 bytes
First seen:2021-04-13 10:01:17 UTC
Last seen:2021-04-13 10:42:28 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:dzqhltFqlMSZ05iMmpRmKW2i2WF5nYjYRslCYFd8ohEMivhHRqgOEexSPk3j6Ey/:JSlLKtZsmpRRW2UKVdYjTOlYzEy7eTT+
TLSH D0B42397BDF1C8467DB1072C68934A52FBB68F537FAFAA1991F59F91AE42888041C081
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "SabriAl.Shami@vacationclub.com" (likely spoofed)
Received: "from vacationclub.com (unknown [185.222.57.157]) "
Date: "13 Apr 2021 01:52:48 -0700"
Subject: "RE:pre alert docs against the subject shipment."
Attachment: "Docs.rar"

Intelligence

File Origin
# of uploads :
4
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a30d10b1377c33016df61636566a6a95c611f1fe44321eb29bfccc88e8516fca/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-13 07:51:02 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=umgrbmjxpqzqc3pwcy3fm2tksxdbd4p6iqzb5mu37tgir2crn7fa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210413-fxfex7lm76/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a30d10b1377c33016df61636566a6a95c611f1fe44321eb29bfccc88e8516fca

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a30d10b1377c33016df61636566a6a95c611f1fe44321eb29bfccc88e8516fca

(this sample)

AgentTesla

Executable exe 14de52bb38d53f186e241de9156d51feb9e2d032f48fedc777693463513d5199

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 14de52bb38d53f186e241de9156d51feb9e2d032f48fedc777693463513d5199

Comments