MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da259a35a45f809399da4173d5a904ef4189b34482b68f6b3602e677e8fe4f32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da259a35a45f809399da4173d5a904ef4189b34482b68f6b3602e677e8fe4f32
SHA3-384 hash: a85943f2759e8aac636e57b3fe30d90112169a68c157927faa065e8f652181bae7f8e1cbd2d1b20350917d7d5c70cdd5
SHA1 hash: 51956f5405039822d129ca83daed1d90cb2f5d4a
MD5 hash: 13339d6dfa1b7515f90c2b011d1933d6
humanhash: red-undress-violet-solar
File name:bank report.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:405'285 bytes
First seen:2022-05-17 08:24:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:qCetrmU+7/uwhlzEA7qb/cnlO0DCC+jOVO:vmw/Pz7qulOgCC+jOVO
TLSH T1B9842366305E7505A6B34412ACFD6EB8C79529914D5FA44FF30CF2632363B8BDB2C289
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "accountgroup <bahtera-azalea@bskh-online.com>" (likely spoofed)
Received: "from bskh-online.com (unknown [45.137.22.229]) "
Date: "17 May 2022 01:45:20 +0200"
Subject: "USD Reverted Funds /Bank Info"
Attachment: "bank report.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe obfuscated packed shell32.dll
Link:
https://www.filescan.io/uploads/62835bedcc43366302d07ba1/reports/689d00ce-9f18-4a02-8cdf-5a6ad0222c22/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/da259a35a45f809399da4173d5a904ef4189b34482b68f6b3602e677e8fe4f32
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da259a35a45f809399da4173d5a904ef4189b34482b68f6b3602e677e8fe4f32/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-17 00:01:53 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3iszunnel6ajhgo2ifz5lkie55aytm2eqk3i62zwalthp2h6j4za._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220517-kbabsabhhp/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/da259a35a45f809399da4173d5a904ef4189b34482b68f6b3602e677e8fe4f32

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip da259a35a45f809399da4173d5a904ef4189b34482b68f6b3602e677e8fe4f32

(this sample)

AgentTesla

Executable exe 2d2d52ba1a0550416131412156d24dcf1e556ecd94feb13f770af0466cafa32a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2d2d52ba1a0550416131412156d24dcf1e556ecd94feb13f770af0466cafa32a
  
Dropping
AgentTesla

Comments