MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a896460d87b28a154dc6d789298bc39545cf0569f2f32a3d5e92fd52d1777f23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 9
| SHA256 hash: | a896460d87b28a154dc6d789298bc39545cf0569f2f32a3d5e92fd52d1777f23 |
|---|---|
| SHA3-384 hash: | bb32007fafccb177c7645f9b634cccc59ebb478f4e2751da7f8e462d08e0a605fc541905946d406049e29a47e97e6e86 |
| SHA1 hash: | 5d909168079c0121c60c02823e4504aa38164b9f |
| MD5 hash: | 722b8f5dd50a76308ff8b15a2ec3d19e |
| humanhash: | three-carolina-virginia-network |
| File name: | 0098COTIZACION ARTICULOS DE OFICINA PARA PRODUCCION.vbs |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 111'030 bytes |
| First seen: | 2022-11-08 13:39:28 UTC |
| Last seen: | Never |
| File type: |  vbs |
| MIME type: | text/plain |
| ssdeep | 384:666666666666q66666666666r66666666666h466666666666D6666666666696K:kM |
| Threatray | 19'717 similar samples on MalwareBazaar |
| TLSH | T1D0B395E8A6721895A50E131F5CBF40D5BD4C67D12313D4C2B9387FCAF897BA2A0829D6 |
| Reporter |  0xToxin |
| Tags: | AgentTesla vbs |
Intelligence
File Origin
# of uploads :
1
# of downloads :
123
Origin country :
ILVendor Threat Intelligence
Detection:
n/a
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Result
Verdict:
SUSPICIOUS
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Threat name:
Script.Downloader.Heuristic
Status:
Malicious
First seen:
2022-11-08 13:40:06 UTC
File Type:
Text
AV detection:
3 of 41 (7.32%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 19'707 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Blocklisted process makes network request
AgentTesla payload
AgentTesla
Malware Config
Dropper Extraction:
http://20.106.255.48/dll/nostartup.pdf
Malware family:
AgentTesla.v3
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.