MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac98ad8459d6535fd8b3cb05a85c7f079cf05fd3a5f48738d6242bf6c9163f2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac98ad8459d6535fd8b3cb05a85c7f079cf05fd3a5f48738d6242bf6c9163f2c
SHA3-384 hash: c423dabcd0288d3f850bf79bbbd34afe9888de3ff553f78622e6159e08c16a495a43f0bcf1b8bb13da66fca4083525f0
SHA1 hash: ffdbbda08628ed47097fa5c99e6b4073d9ec66b2
MD5 hash: c4754e597009f98ad94a3538b322d885
humanhash: north-cold-autumn-twenty
File name:1619693418.Vfc11I22caf3M79911.dynamene_Quotation 90809.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:645'897 bytes
First seen:2021-04-29 17:32:23 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:C73N9JCw9jPrkqBTdxXxkCLoRO/HBcTKJyUAhPl8TisAhHBS:WX3UqB558MHaEBAv8cBS
TLSH C2D423739CFBF517A2B2DE2A9D0D3248E2BAC4659B06787C877083B16D0211D6D509EF
Reporter GovCERT_CH

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ac98ad8459d6535fd8b3cb05a85c7f079cf05fd3a5f48738d6242bf6c9163f2c/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-29 17:33:10 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vsmk3bcz2zjv7wftzmc2qxd7a6opax6tux2ioogweqv7nsiwh4wa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210429-4kfg6fjxpa/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot1770934552:AAHAVQxHQ_XENvYPA40Q-pAHCskMigtFs8M/sendDocument
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ac98ad8459d6535fd8b3cb05a85c7f079cf05fd3a5f48738d6242bf6c9163f2c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ac98ad8459d6535fd8b3cb05a85c7f079cf05fd3a5f48738d6242bf6c9163f2c

(this sample)

AgentTesla

Executable exe e68ed3c8410046c2fc22a4074df23864d98e085862320ffbf8e5f8dc5a700eaa

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e68ed3c8410046c2fc22a4074df23864d98e085862320ffbf8e5f8dc5a700eaa
  
Dropping
MD5 faef4cb92fcbb1d2954caa4edc13856a

Comments