MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0fe6f5c28b546c97a726526ed0bf38c038b924fc4e1fc650eb1812e4df36cb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b0fe6f5c28b546c97a726526ed0bf38c038b924fc4e1fc650eb1812e4df36cb9
SHA3-384 hash: 370dd6850a4d581834509735566cf77715e06dc7ee6f981f8ee84c7ef534ecb885a6c08906e1ed2f05beb74f95270eb4
SHA1 hash: a189b16fd7a20d27f970ef5bd7a048b338627f22
MD5 hash: 197d80769cd270dd4bfe27a8629225b2
humanhash: kansas-spring-utah-lithium
File name:New Purchase order.R13
Download: download sample
Signature AgentTesla
Create hunting rule
File size:701'821 bytes
First seen:2021-04-20 07:18:26 UTC
Last seen:2021-04-20 14:36:33 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:3WKUSXRb8GmZ5cgZZ35uCD0iEXziyiGZAmnNkQzjL9+iuu9VoK746:dU+jmZ5cgZTBDpEXz8GZDnyU39Vl46
TLSH 47E4334EE57D10225CF675FB2A62B210E2C85DB4F98C57044C36DA29EFAE0D44CACCAD
Reporter lowmal3
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
4
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.667.25031.23888.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b0fe6f5c28b546c97a726526ed0bf38c038b924fc4e1fc650eb1812e4df36cb9/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wd7g6xbiwvdms6tsmuto2c7trqbyxespytq7yziowgas4tptns4q._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210420-1gsxn6sjjn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
AgentTesla Payload
Looks for VirtualBox Guest Additions in registry
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b0fe6f5c28b546c97a726526ed0bf38c038b924fc4e1fc650eb1812e4df36cb9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar b0fe6f5c28b546c97a726526ed0bf38c038b924fc4e1fc650eb1812e4df36cb9

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments