MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c95df0a75bc1e5f7efda4923d9c6a05ed9623dc84762ebae083f644bfe10ea09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c95df0a75bc1e5f7efda4923d9c6a05ed9623dc84762ebae083f644bfe10ea09
SHA3-384 hash: 2499146c1a93fca9681c8b02dd6fcfb80e5586ad84b139d245670c0db8ec45b0f9e1ae34085e0a526d19bbf4cbbbee75
SHA1 hash: cb13c16dd891c46e739ec8a284bd9467c34893bf
MD5 hash: 966cf521891fa8dedbf34a6c3bb6c5b3
humanhash: football-sad-cup-beryllium
File name:Arrival Notice 15,08,2022.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:511'057 bytes
First seen:2022-08-16 09:41:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:xwHyzXJXJ7bGCEY2+xxHFCy4886eLQD1tVDz0T:xwH6tb2OlF9i6+Qh7H0T
TLSH T19AB42395BB6E024CFB543D4B898B32C1C9219E3DE9748843D4D2D3A9B859F0D8B9A711
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla Shipping zip


Avatar
cocaman
Malicious email (T1566.001)
From: "mssp@msshipping.kr" (likely spoofed)
Received: "from msshipping.kr (unknown [185.222.58.76]) "
Date: "09 Aug 2022 05:23:24 +0200"
Subject: "Arrival Notice/ ETA : 15/08/2022"
Attachment: "Arrival Notice 15,08,2022.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
166
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Sanesecurity.Rogue.0hr.20220809-1234.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62fb66707a5eee50480f7e09/reports/a26875af-a68d-481f-b261-3373294495e5/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/c95df0a75bc1e5f7efda4923d9c6a05ed9623dc84762ebae083f644bfe10ea09
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c95df0a75bc1e5f7efda4923d9c6a05ed9623dc84762ebae083f644bfe10ea09/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-08-09 02:39:09 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
21 of 40 (52.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zfo7bj23yhs7p362jer5trval3mwepoii5roxlqih5sex7qq5ieq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220816-lpb8zafcdn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Drops file in Drivers directory
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c95df0a75bc1e5f7efda4923d9c6a05ed9623dc84762ebae083f644bfe10ea09

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c95df0a75bc1e5f7efda4923d9c6a05ed9623dc84762ebae083f644bfe10ea09

(this sample)

AgentTesla

Executable exe 27d76e488a1d3543ca5d239fe2fd06e43af57ab5fd40e0e28ba5faa5c0700cbc

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 27d76e488a1d3543ca5d239fe2fd06e43af57ab5fd40e0e28ba5faa5c0700cbc
  
Dropping
AgentTesla

Comments