MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b16c0a46e9b937bea6507a4fc6489529aa98dfb464034897edbaec3967db3708. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 4
| SHA256 hash: | b16c0a46e9b937bea6507a4fc6489529aa98dfb464034897edbaec3967db3708 |
|---|---|
| SHA3-384 hash: | dedca46da9f01995b0e5e722ab78f8d3507b9a6c2793c41c70625220afcd90564a6530048607b7137837ebbe184f42f3 |
| SHA1 hash: | 645b48530516244606567aab530723ef7e4ab4aa |
| MD5 hash: | 8463a951e1e6398b8dc6024c603a94b0 |
| humanhash: | fix-washington-triple-alabama |
| File name: | SHIPPING DOC.zip |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 440'548 bytes |
| First seen: | 2023-01-24 08:00:16 UTC |
| Last seen: | 2023-01-24 08:23:37 UTC |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 12288:GRozXrz8UYenIwLZnK1fGzZ8D2WN0Jk0j:8KvtfLZnkfGzSD2O0Jk0j |
| TLSH | T13694237ABA368F53EC1E290E84C24F1B181BF3EA31F1CCE67168C8A9077957579D450A |
| TrID | 80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1) |
| Reporter |  cocaman |
| Tags: | AgentTesla DHL INVOICE Shipping zip |
cocaman
Malicious email (T1566.001)From: "=?UTF-8?B?SklTT09LIEtJTSAo6rmA7KeA7IiZKSAvR2VuZXJhbCBNYW5hZ2Vy?=<export@glinkkorea.com>" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.136]) "
Date: "24 Jan 2023 05:33:06 +0100"
Subject: "RE:SHIPPING DOCUMENT"
Attachment: "SHIPPING DOC.zip"
Intelligence
File Origin
# of uploads :
3
# of downloads :
88
Origin country :
n/a
File Archive Information
This file archive contains 1 file(s), sorted by their relevance:
| File name: | SHIPPING DOC.exe |
|---|---|
| File size: | 466'944 bytes |
| SHA256 hash: | 41d58a31e2befb91705b4630f2cc48bfe9c09d5c26aee2034e5279b7bb314f4c |
| MD5 hash: | be6e96850422bc9cbbb53dd6bffb461b |
| MIME type: | application/x-dosexec |
| Signature | AgentTesla |
Vendor Threat Intelligence
Detection(s):
Result
Verdict:
Unknown
File Type:
PE File
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
cerbu packed vidar
Result
Verdict:
MALICIOUS
Link:
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
collection
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Uses the VBS compiler for execution
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
AgentTesla
zip b16c0a46e9b937bea6507a4fc6489529aa98dfb464034897edbaec3967db3708
(this sample)
exe Delivery method
Distributed via e-mail attachment
Dropping
AgentTesla
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.