MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d176aaeb3b1547248d249f83da246397622bbd665c3d22adb68414fd053a4baf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d176aaeb3b1547248d249f83da246397622bbd665c3d22adb68414fd053a4baf
SHA3-384 hash: a1179773e7b2d7107d31fdd621933d71c5452332601d85bff36c0849860bfb7e9796a5d8edd31f5c1d18552914c1bf82
SHA1 hash: 2e01df4a541647dcc9703b490ca3d734c273f3f2
MD5 hash: 597e16680f998fd376fee9a584ce6924
humanhash: papa-salami-london-ack
File name:INVOICE.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:423'931 bytes
First seen:2022-04-29 10:46:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:hpBK14RGwVRnGZ1dleqIp1tFoXA1/mHew:TBKGUru3p1TBFw
TLSH T1A6942334017198E5704C5F2B0087B73916E02016DFAFD9F46BB3DB9F456D29AAA3C0B9
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla INVOICE payment zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""CAPT. ELFATIH M. IDRIS)" <gulegul@bybetiket.com>" (likely spoofed)
Received: "from bybetiket.com (unknown [185.222.57.240]) "
Date: "25 Apr 2022 22:53:26 +0200"
Subject: "Re: Advice for your payment"
Attachment: "INVOICE.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn23.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.1307.10615.22001.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22125.ZipHeur.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe fareit obfuscated packed
Link:
https://www.filescan.io/uploads/626bc22875c6f158e802dca8/reports/c7c07388-721f-43b7-adde-0191c0e775b9/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/d176aaeb3b1547248d249f83da246397622bbd665c3d22adb68414fd053a4baf
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d176aaeb3b1547248d249f83da246397622bbd665c3d22adb68414fd053a4baf/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-25 07:19:20 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
23 of 39 (58.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2f3kv2z3cvdsjdjet6b5ujdds5rcxplglq6sflnwqqkp2bj2joxq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220429-mvh45sefan/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d176aaeb3b1547248d249f83da246397622bbd665c3d22adb68414fd053a4baf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d176aaeb3b1547248d249f83da246397622bbd665c3d22adb68414fd053a4baf

(this sample)

AgentTesla

Executable exe c12df0047904d1a9d897ab81bb38760f2cde3041b3660497ef82e23a53c3a3ca

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c12df0047904d1a9d897ab81bb38760f2cde3041b3660497ef82e23a53c3a3ca
  
Dropping
AgentTesla

Comments