MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abef74a699cc498ba7b686dc2a3199e66d485dba0d79aa7e932e381f373baafd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: abef74a699cc498ba7b686dc2a3199e66d485dba0d79aa7e932e381f373baafd
SHA3-384 hash: 6fa81bd54eab307c9bf2794842f50d43962a63f7eefad8dc84eb9bfc57a67f72a696b116ab633c5a4dfd71cc16e80c62
SHA1 hash: 319fd8abb826c831b5764e11e2391a3f87588868
MD5 hash: f73bb006bc07e9ed7c4646f195e0d56e
humanhash: alabama-dakota-illinois-september
File name:Invoice.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:256'513 bytes
First seen:2022-05-06 16:50:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:JnawrH9AWyWJ3CHG7HaYI5/DhtuQcZ20Z2SnK+w:1aydmW53HgLhtuQcZb8Sjw
TLSH T17E442308F25959C6B625EF89D648952DE08F59838E98278BCD2D38F46BFE2713934C21
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla INVOICE zip


Avatar
cocaman
Malicious email (T1566.001)
From: "service@hatecke.de" (likely spoofed)
Received: "from hatecke.de (unknown [45.137.22.85]) "
Date: "06 May 2022 08:13:51 +0200"
Subject: "RE: PROFORMA INVOICE PI160256"
Attachment: "Invoice.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
349
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn23.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.6896.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25244.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21103.ZipHeur.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/62755226f83e35ebf4ee3bdb/reports/f013eef5-ad68-4c73-a1e7-c89443e8988c/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/abef74a699cc498ba7b686dc2a3199e66d485dba0d79aa7e932e381f373baafd
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/abef74a699cc498ba7b686dc2a3199e66d485dba0d79aa7e932e381f373baafd/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-06 06:35:35 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
19 of 40 (47.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vpxxjjuzzreyxj5wq3ocummz4zwuqxn2bv42u7utfy4b6nz3vl6q._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer suricata trojan
Link:
https://tria.ge/reports/220506-vcs6dschdr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
Executes dropped EXE
AgentTesla
suricata: ET MALWARE AgentTesla Exfil Via SMTP
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/abef74a699cc498ba7b686dc2a3199e66d485dba0d79aa7e932e381f373baafd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip abef74a699cc498ba7b686dc2a3199e66d485dba0d79aa7e932e381f373baafd

(this sample)

AgentTesla

Executable exe 3ce612b0f9fe428cee187e2c135bb42db9054307d1704101bb54f5235dd1bdd9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3ce612b0f9fe428cee187e2c135bb42db9054307d1704101bb54f5235dd1bdd9
  
Dropping
AgentTesla

Comments