MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad00ca7baa00c80a8bed2c048d1e538e1d1fab74f8826052cbca41d253cb1a90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad00ca7baa00c80a8bed2c048d1e538e1d1fab74f8826052cbca41d253cb1a90
SHA3-384 hash: 0592a43dd00c03b901b22902a71f3a178d9f38d9f37b531859fe40840ce947c8fde4d76afe42c9c2879371a1e4cd037c
SHA1 hash: 10ab038fe8c166b8ffcfd92178ec2402076c4960
MD5 hash: dfc14730c250d23e5066c8c2bd80886f
humanhash: lactose-ack-muppet-magnesium
File name:payment details.r15
Download: download sample
Signature AgentTesla
Create hunting rule
File size:440'828 bytes
First seen:2022-05-24 06:54:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:OdQPMOoxOopd5pP3PFqRN7bnKsQ6yMl3irjl+3st:aIqfXPFqrOdMl3irjg3st
TLSH T1D69423427673DE07B08913B92E7A629F921CB6A6D0C1B95C3F83171EF15B6BB04C7252
TrID 58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1)
41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:AgentTesla payment r15 rar


Avatar
cocaman
Malicious email (T1566.001)
From: "aiyavee@thaimach.co.th" (likely spoofed)
Received: "from thaimach.co.th (unknown [185.222.58.88]) "
Date: "24 May 2022 08:53:30 +0200"
Subject: "Re: Bank Confirmation // Transfer 108,700 Euros dated 24-05-2022"
Attachment: "payment details.r15"

Intelligence

File Origin
# of uploads :
1
# of downloads :
295
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm obfuscated packed
Link:
https://www.filescan.io/uploads/628c814865e338159937d204/reports/7ba09106-02ce-4c46-8c9f-1f34c4cafae2/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad00ca7baa00c80a8bed2c048d1e538e1d1fab74f8826052cbca41d253cb1a90/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-24 04:51:07 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vuamu65kadeavc7nfqci2hstryor7k3u7cbgauwlzja5eu6ldkia._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220524-hpr3msbafn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Drops file in Drivers directory
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5227573794:AAECZBnQSxLs0aOVsV2wnclC6-WKnxPpi_k/sendDocument
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ad00ca7baa00c80a8bed2c048d1e538e1d1fab74f8826052cbca41d253cb1a90

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ad00ca7baa00c80a8bed2c048d1e538e1d1fab74f8826052cbca41d253cb1a90

(this sample)

AgentTesla

Executable exe 9c91e4ad7f628daad6e529f0bd038ae3a6bf1c8bb402f24ebced1a97b78dc193

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9c91e4ad7f628daad6e529f0bd038ae3a6bf1c8bb402f24ebced1a97b78dc193
  
Dropping
AgentTesla

Comments