MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3b08a487783361e912b2c0f128cefe5be2d7862af0d55b44a223b067dc9d5b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3b08a487783361e912b2c0f128cefe5be2d7862af0d55b44a223b067dc9d5b2
SHA3-384 hash: f85f85b089e096bf677425cf6868acc6e8d849862e118ed26a0bd47aa7e2c4e079efd10c061b3679d543911b8034421b
SHA1 hash: 0b1789799b9efd6f95ffb2862e999628f18444ab
MD5 hash: 31f8cfef0a53faa6e6867663427ee81a
humanhash: butter-august-skylark-massachusetts
File name:New Order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:757'361 bytes
First seen:2021-04-26 12:41:56 UTC
Last seen:2021-04-26 12:42:27 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:CRThQLxxiPZYLeM53PHanI+58l5VuL+17fSbkkJpoWOGY91k5hrHqSPm:otQLxx11fatsVQ9bkITOGAu5hrKSPm
TLSH 07F423B0DFBA876AFE6B8CF22944850CDD64E743590374FA1B364769193C05847FEA82
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""Sunny-sales" <sales04@nbsunny.cn>" (likely spoofed)
Received: "from nbsunny.cn (unknown [45.137.22.107]) "
Date: "26 Apr 2021 05:18:08 -0700"
Subject: "ORDER/APRIL 26,2021"
Attachment: "New Order.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20210426-1203.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.20634.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22623.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/b3b08a487783361e912b2c0f128cefe5be2d7862af0d55b44a223b067dc9d5b2
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3b08a487783361e912b2c0f128cefe5be2d7862af0d55b44a223b067dc9d5b2/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-26 07:59:29 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=woyiusdxqm3b5ejlfqhrfdhp4w7c26dcv4gvlnckei5qm7oj2wza._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210426-2e92msldex/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/b3b08a487783361e912b2c0f128cefe5be2d7862af0d55b44a223b067dc9d5b2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b3b08a487783361e912b2c0f128cefe5be2d7862af0d55b44a223b067dc9d5b2

(this sample)

AgentTesla

Executable exe fbeb8a00dc1e958486c53e63231f293ddd791b76a952ce15d35ef6b087f41db9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fbeb8a00dc1e958486c53e63231f293ddd791b76a952ce15d35ef6b087f41db9
  
Dropping
AgentTesla

Comments