MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aac191cc316509f0ace5358a185e43a8d221c2f8374760ee8fdbbca632674bd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aac191cc316509f0ace5358a185e43a8d221c2f8374760ee8fdbbca632674bd2
SHA3-384 hash: c8c436c0535e4f4c685fa445de85668306afaa265449657bc64b8e8431f91e5ed83d69963892ff3897bdb355b82462c5
SHA1 hash: 2c4372f2db7f08bd62c42aee7a5e81c963b5bdcc
MD5 hash: 00cb71cdbb8475efe08fa6759a9c6dfa
humanhash: nine-hawaii-earth-mango
File name:ACCOUNT FORM.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:797'689 bytes
First seen:2021-09-26 18:11:16 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 24576:rx4V04dJVPZ6luuWGWSbAlfTpqM1eGzft06WEo:rS0AqWqAlfTdm6G
TLSH T11A0533852418FEF5D1448B2638AF7A5EBB88777D94BD9C5F90EA2312C5153E8013BB0B
Reporter fabjer
Tags:7z

Intelligence

File Origin
# of uploads :
1
# of downloads :
247
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.1037-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aac191cc316509f0ace5358a185e43a8d221c2f8374760ee8fdbbca632674bd2/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-26 11:07:52 UTC
AV detection:
15 of 45 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vlazdtbrmue7blhfgwfbqxsdvdjcdqxyg5dwb3up3o6kmmthjpja._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210926-ws6xvsfcb2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aac191cc316509f0ace5358a185e43a8d221c2f8374760ee8fdbbca632674bd2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z aac191cc316509f0ace5358a185e43a8d221c2f8374760ee8fdbbca632674bd2

(this sample)

AgentTesla

Executable exe 123de48e610d4e6dacfb9722ccf5073154cd419537a7b60aa510d81e06e51404

  
Dropping
SHA256 123de48e610d4e6dacfb9722ccf5073154cd419537a7b60aa510d81e06e51404
  
Delivery method
Distributed via e-mail attachment

Comments