MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cdc6f7d17ba04cf4b1f66126c1d8b7bb14cf6e7cf0d600fdfb92904262cd2fb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cdc6f7d17ba04cf4b1f66126c1d8b7bb14cf6e7cf0d600fdfb92904262cd2fb5
SHA3-384 hash: 87079d40bbc3eb56eade95e73cbda0d19067b7c444bf7083278a8c337ff0c0e016898cfac05db3412ae93af60ba30301
SHA1 hash: e5e5599f20291b05ddf49ba33e421558895be635
MD5 hash: 6328e4ce2a827c2026aaaefbba470e9b
humanhash: foxtrot-beryllium-batman-missouri
File name:Scan 20210507_178854.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:661'076 bytes
First seen:2021-05-07 05:18:24 UTC
Last seen:2021-05-07 06:01:50 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:FDRRTKBr+Y+GyNTkaq+BexhJLXaB00mZPg/9+of4RTwycFxlBfFMNoc1ubw:zRrYTyNTkaqTdqqRgzSTzcFfBfFMcbw
TLSH DBE423915123B88BFB04D9ACE2AA0513A04FDFC51B15AC8AC5536EB296BDF3C775E024
Reporter cocaman
Tags:INVOICE zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Sofien Ben JEMAA <info@4sps.in>" (likely spoofed)
Received: "from 4sps.in (unknown [103.133.106.100]) "
Date: "6 May 2021 19:21:18 -0700"
Subject: "CHM invoice"
Attachment: "Scan 20210507_178854.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.624-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/cdc6f7d17ba04cf4b1f66126c1d8b7bb14cf6e7cf0d600fdfb92904262cd2fb5
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cdc6f7d17ba04cf4b1f66126c1d8b7bb14cf6e7cf0d600fdfb92904262cd2fb5/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-07 05:19:13 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
4 of 47 (8.51%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zxdppul3ubgpjmpwmetmdwfxxmkm63t46dlab7p3skieeywnf62q._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210507-zhpzl8q7nn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cdc6f7d17ba04cf4b1f66126c1d8b7bb14cf6e7cf0d600fdfb92904262cd2fb5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip cdc6f7d17ba04cf4b1f66126c1d8b7bb14cf6e7cf0d600fdfb92904262cd2fb5

(this sample)

AgentTesla

Executable exe 6e8ac50a9010c4a45d57ee0095c2cb1989ce6d4a453746920e1dcb3ec43e3c85

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6e8ac50a9010c4a45d57ee0095c2cb1989ce6d4a453746920e1dcb3ec43e3c85

Comments