MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcd267aca9b6a4b802cd10532cae28325bb0d42edf6a9152ea905f2bd1a16ca9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcd267aca9b6a4b802cd10532cae28325bb0d42edf6a9152ea905f2bd1a16ca9
SHA3-384 hash: 4e91f4dab1c62446af5f736dfe1248dd697d2b016318e635cf3bf2491e24c2ad633670e697a34df8a60dfc81f0512d5f
SHA1 hash: 7d2cee0b9c8684f38afc92e56ae0fdfe03c74712
MD5 hash: ed79eb075846b48b891eace6614dc80a
humanhash: single-berlin-island-robin
File name:Balance sheet xxls.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:645'723 bytes
First seen:2021-11-01 15:47:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:o4TYYeMobL5RwmHd5a0gu8dziri0yU6AmEvYcJEnbz1kh+sE:oemfMq8M8UPyJAmcJEP1kha
TLSH T11FD433A75A29D65D232B67D6379FE800F903628AEB59DC7C034B610DB366C214D92FC3
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Nguyen Mai Phuong <nmphuong@thermtrol.com>" (likely spoofed)
Received: "from thermtrol.com (unknown [103.232.53.21]) "
Date: "1 Nov 2021 08:45:20 -0700"
Subject: "RE RE Balance Confirmation at 30-Nov-2018 _ TDSL01 _ Thermtrol (VSIP)"
Attachment: "Balance sheet xxls.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61800c36a9d585e6d53d6acb/reports/ec3cc7b7-13dc-4f18-80bf-375b84938f81/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dcd267aca9b6a4b802cd10532cae28325bb0d42edf6a9152ea905f2bd1a16ca9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-01 15:22:31 UTC
AV detection:
12 of 44 (27.27%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3tjgplfjw2slqawncbjszlrigjn3bvbo35vjcuxksbpsxunbnsuq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/211101-s8shmafbcj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dcd267aca9b6a4b802cd10532cae28325bb0d42edf6a9152ea905f2bd1a16ca9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar dcd267aca9b6a4b802cd10532cae28325bb0d42edf6a9152ea905f2bd1a16ca9

(this sample)

AgentTesla

Executable exe 726d0e508391cb947a0c827c636e1f21be5e201f18949a4a1e03f0360d603dc4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 726d0e508391cb947a0c827c636e1f21be5e201f18949a4a1e03f0360d603dc4

Comments