MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e10abc8c60c97545194b980822a27748fa27c0e042a161a85c662df8743a697c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	e10abc8c60c97545194b980822a27748fa27c0e042a161a85c662df8743a697c
SHA3-384 hash:	7b03a3a37950395b6f0e5ac45b86158405386715e47ea453e19c633aa60a18a7257e8659b908538981cfe61cfc9e9b14
SHA1 hash:	fbafcb2b960de87df69c055cd02ea6202a8045d5
MD5 hash:	c4d4a68fb1ae3ac91fd4455ddc952a31
humanhash:	fanta-louisiana-sweet-purple
File name:	SOA.zip
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	835'740 bytes
First seen:	2022-12-01 09:07:06 UTC
Last seen:	2022-12-01 09:07:34 UTC
File type:	zip
MIME type:	application/zip
ssdeep	24576:D/a9EoYTftKrKxRZEcQPWE8OZZY31dWpX+8Cy:DS9EoE5x3EPueZ6Deb
TLSH	T14B05234AD179A1CB88A2A5B08CED2389FF0D0E32AED5114054F38BE5687B5B459DDFCC
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	AgentTesla payment zip

cocaman

Malicious email (T1566.001)
From: "elsam@ola-logistics.com" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.237]) "
Date: "1 Dec 2022 10:06:08 +0100"
Subject: "Due Payment Follow UP"
Attachment: "SOA.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

119

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	SOA.exe
File size:	980'480 bytes
SHA256 hash:	28da4dc581a7a99fddff8eef31876687c6c64a0564c35f1b9bab984fc9c9160c
MD5 hash:	37fc2dd0e03f8c08ab76ac604706d69a
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Zip_fs1292.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/63886ef3579915b6b303c61d/reports/069b7710-5680-49b2-b06a-7b33ed60dc3f/overview

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/e10abc8c60c97545194b980822a27748fa27c0e042a161a85c662df8743a697c

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e10abc8c60c97545194b980822a27748fa27c0e042a161a85c662df8743a697c/

Threat name:

ByteCode-MSIL.Trojan.RealProtect

Status:

Malicious

First seen:

2022-12-01 07:46:52 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4eflzddazf2ukgkltaecfitxjd5cpqhaikqwdkc4myw7q5b2nf6a._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/221201-lvj6rsff37/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Checks computer location settings

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e10abc8c60c97545194b980822a27748fa27c0e042a161a85c662df8743a697c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.