MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bef4e5abb9adf92e6a22c1ddfce219a9b01aad4446516ae5455923a1cbba7b6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 7
| SHA256 hash: | bef4e5abb9adf92e6a22c1ddfce219a9b01aad4446516ae5455923a1cbba7b6b |
|---|---|
| SHA3-384 hash: | 3f50d297e9e75803c6c47bf664df268bf16ef8a5a4527abd6572ea3596e9ba1d0b3c1f6a1133031386340af5c2773c07 |
| SHA1 hash: | 3afb8e17beaef22194dfdfe99ffde12466fce647 |
| MD5 hash: | 260cae636fc2c2d3a17704921bf03629 |
| humanhash: | sink-wyoming-tennessee-zulu |
| File name: | Invoice and Payment.zip |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 413'987 bytes |
| First seen: | 2022-04-14 07:24:47 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 6144:0YOlswU+YijNxANH5kCjF/Q/V8k4tQAyPkpL8lpYujJBGCLIl0+zSST9HNoNKrS:CswxJj/MHZ1NVvyPg87YuTGoIlUvKW |
| TLSH | T1449423E90830E091B64A29BFD85AC670B725581DC16D8125F658F7EF6131FF0A7ACC1E |
| Reporter |  cocaman |
| Tags: | AgentTesla INVOICE payment zip |
cocaman
Malicious email (T1566.001)From: "Kristen Williams <kwilliams@cadenterprises.com>" (likely spoofed)
Received: "from yandex.ru (unknown [2.56.59.58]) "
Date: "13 Apr 2022 22:20:13 +0200"
Subject: "RE: <EXTERNAL>Invoice and Payment for April 2022."
Attachment: "Invoice and Payment.zip"
Intelligence
File Origin
# of uploads :
1
# of downloads :
253
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
fareit obfuscated packed
Result
Verdict:
MALICIOUS
Link:
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-04-13 16:35:28 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
24 of 41 (58.54%)
Threat level:
5/5
Detection(s):
Malicious file
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Dropping
AgentTesla
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.