MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0dd8bff476b1b88d6ed3ec43cf0d8dd711ab2fb7465561f989fd91cef444ca3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0dd8bff476b1b88d6ed3ec43cf0d8dd711ab2fb7465561f989fd91cef444ca3
SHA3-384 hash: 3dbde2550ae52d9bbca8eff9a9b89bf201124e1ee3849ba1bbcfabda746cc987fb60a9767d5d56113a38a3898fea2c40
SHA1 hash: 472537bfac2a539e8c0c80d6f39dfdfbc23fa06f
MD5 hash: ae5b7dd1f6a5e66f192f1d75f5134596
humanhash: winner-arizona-lion-massachusetts
File name:PO I-3ACT-PU-070 rev.01.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:502'151 bytes
First seen:2021-05-10 05:32:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:hitcQLoN4s/TeYc1WW4/4TVEB6r6Me7tWLFqz:QqQu4s/TeYIdJr6MmWLE
TLSH 04B4238A89A4032EB10022A43EE824CD8A5EB87BD5D5CB5DC95BB03DFDD72B94D746C1
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Purchasing Foreman <tac_purch_01@3acltd.com>" (likely spoofed)
Received: "from mail.radiohellenic.gr (mail.radiohellenic.gr [178.77.99.30]) "
Date: "Mon, 10 May 2021 03:46:07 +0100"
Subject: "RE: New PO. I-3ACT-PU-070 rev.01 on May10 2021"
Attachment: "PO I-3ACT-PU-070 rev.01.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.43091.30927.6679.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/e0dd8bff476b1b88d6ed3ec43cf0d8dd711ab2fb7465561f989fd91cef444ca3
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e0dd8bff476b1b88d6ed3ec43cf0d8dd711ab2fb7465561f989fd91cef444ca3/
Threat name:
ByteCode-MSIL.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2021-05-10 05:33:27 UTC
File Type:
Binary (Archive)
Extracted files:
39
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4doyx72hnmnyrvxnh3cdz4gy3vyrvmx3orsvmh4yt7mrz32ejsrq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210510-frgehvw6da/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Contains code to disable Windows Defender
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e0dd8bff476b1b88d6ed3ec43cf0d8dd711ab2fb7465561f989fd91cef444ca3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e0dd8bff476b1b88d6ed3ec43cf0d8dd711ab2fb7465561f989fd91cef444ca3

(this sample)

AgentTesla

Executable exe 3ab4992a55bf19ce9d855ed0ff10f965e9d51f07b8b214436bbabd2f2ecd5c92

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3ab4992a55bf19ce9d855ed0ff10f965e9d51f07b8b214436bbabd2f2ecd5c92
  
Dropping
AgentTesla

Comments