MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 adbc65c5079f2678826323f69866e68c53b68e1317dd2650e989f9442256c765. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: adbc65c5079f2678826323f69866e68c53b68e1317dd2650e989f9442256c765
SHA3-384 hash: aa4de017643381c6fc7661881a1b473626945d016e552ef031d5aa0d0c27d2c884c453b61c9824806fe061ea8da6a351
SHA1 hash: 749fbb0cb8b4a2e6db32f96c5e157fe513f52235
MD5 hash: 1c8450176a8056b5630bceb1a89fa458
humanhash: lemon-nuts-shade-asparagus
File name:EPDA.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:460'956 bytes
First seen:2022-01-18 08:14:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:FN3IQa2/+lmvW+UCxG0uFt7rEWd9QvmPQ0/gowXEb2YOypMf9:FN3IE/+l2WFCtunrEWd+YQ0/9wX1yA
TLSH T1E5A423DDBDD54BCB440C3E4601E6520D4DA43ABA8F8FD16211DD93F04F4AB1A8CAA9E7
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "csacjpqsw@cnshipping.com <csacjpqsw@cnshipping.com>" (likely spoofed)
Received: "from cnshipping.com (unknown [103.89.88.177]) "
Date: "18 Jan 2022 00:11:31 -0800"
Subject: "MV ROBERTA epda"
Attachment: "EPDA.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
193
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe obfuscated packed
Link:
https://www.filescan.io/uploads/61e6770b0f8c757253c7ad40/reports/cf86472d-9855-4d17-b13d-f4aacb54490d/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/adbc65c5079f2678826323f69866e68c53b68e1317dd2650e989f9442256c765/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-01-18 08:15:13 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vw6glriht4thratdep3jqzxgrrj3ndqtc7osmuhjrh4uiiswy5sq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220118-j5k5psacb7/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.84
Link:
https://yomi.yoroi.company/submissions/adbc65c5079f2678826323f69866e68c53b68e1317dd2650e989f9442256c765

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar adbc65c5079f2678826323f69866e68c53b68e1317dd2650e989f9442256c765

(this sample)

AgentTesla

Executable exe 8d42c95e56474e1c3500e5d52f45c853a0b9f9724a2cdbb2eb3d986057b1978d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8d42c95e56474e1c3500e5d52f45c853a0b9f9724a2cdbb2eb3d986057b1978d
  
Dropping
AgentTesla

Comments