MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a630845f4da31f367b7ebf3902df87e1f8b607597c273d16e8f1bcce5607ab12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a630845f4da31f367b7ebf3902df87e1f8b607597c273d16e8f1bcce5607ab12
SHA3-384 hash: 1c6f2f6e9f21449c9bb77a90c52b4326d912c2b9cd89a07e0254d1fc638f03c8f5ada5e125d0e021d835d2db84d348ed
SHA1 hash: fbb8d6b500f8dcc15125fc8a8a133868a29038ea
MD5 hash: 409660d2b19863a93f00d6c5c82c5320
humanhash: mike-east-hydrogen-march
File name:Swift copy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:623'308 bytes
First seen:2021-04-23 12:08:22 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:PEqqZVvsOj5RN9Zreh3GlhYP24wAjLfRenviLQIsvrOVyHf+0zB:PEqKVvsOjRvreh1P243VciLQbvrOMf+E
TLSH 73D4232BEEE21DD528D106E66C69105FD3AD49B97FB083267742891CEA8DCD4C84F8F1
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn112.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21743.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/a630845f4da31f367b7ebf3902df87e1f8b607597c273d16e8f1bcce5607ab12
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a630845f4da31f367b7ebf3902df87e1f8b607597c273d16e8f1bcce5607ab12/
Threat name:
ByteCode-MSIL.Trojan.Stelega
Create hunting rule
Status:
Malicious
First seen:
2021-04-23 05:52:07 UTC
AV detection:
17 of 47 (36.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uyyiix2numptm636x44qfx4h4h4lmb2zpqtt2fxi6g6m4vqhvmja._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210423-hdh355ffk2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot1487657528:AAFnNHLAtj_ujed9_IjvpSguj8z_a4GKbog/sendDocument
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/a630845f4da31f367b7ebf3902df87e1f8b607597c273d16e8f1bcce5607ab12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a630845f4da31f367b7ebf3902df87e1f8b607597c273d16e8f1bcce5607ab12

(this sample)

AgentTesla

Executable exe be4fed0d40623475b3ad736c732fdae9ec9532e5ecaf9d01152770240c419aa2

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 be4fed0d40623475b3ad736c732fdae9ec9532e5ecaf9d01152770240c419aa2
  
Dropping
MD5 aa69fcd1eeb3bfeb05ffc8e19f8b44f0

Comments