MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e19df52cb5cb5260eff0a45351aab4de7bcc22ad976cf1286b13f5e26efb988e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e19df52cb5cb5260eff0a45351aab4de7bcc22ad976cf1286b13f5e26efb988e
SHA3-384 hash: 658a5912e6093d86a5674a8f5327604112baa28a5a3fbf582315d13fda7f976f5a6ce0b4caa5c441aba24f5825920e1e
SHA1 hash: 09586e9d1a7a2abcba696d612c66c1b829be3c43
MD5 hash: 0b42c5e42d778442c4b02144913bf319
humanhash: utah-lima-bravo-vermont
File name:Scan doc.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:717'789 bytes
First seen:2021-07-13 05:09:48 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:JjMJ3gKWNZdQbVP/mVp31XewhmldBefwrtIh9nvYinGUvPOq0VJGcPfnytHjTMhp:6JwH+xi1Oy8vZSvYAJvPZ0VJVfnytDQD
TLSH T101E433AB0014D056D7DB38550A831DAFBD62924BBBBD5BB13B0C0CD7972DB93095B22B
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Robert Chen <contacto@mesonjulian.com>" (likely spoofed)
Received: "from ns332240.ip-188-165-225.eu (ns332240.ip-188-165-225.eu [188.165.225.23]) "
Date: "Tue, 13 Jul 2021 03:42:36 +0200"
Subject: "New Customer Purchase Order Document(s)"
Attachment: "Scan doc.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e19df52cb5cb5260eff0a45351aab4de7bcc22ad976cf1286b13f5e26efb988e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-13 03:05:33 UTC
File Type:
Binary (Archive)
Extracted files:
29
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4go7klfvznjgb37qurjvdkvu3z54yivns5wpckdlcp26e3x3tcha._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210713-h38tvgfgxn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/e19df52cb5cb5260eff0a45351aab4de7bcc22ad976cf1286b13f5e26efb988e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e19df52cb5cb5260eff0a45351aab4de7bcc22ad976cf1286b13f5e26efb988e

(this sample)

AgentTesla

Executable exe 6ebaa542dcd9f166b05338acb13c4c757cff7bf13305be412b9617e127924c88

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6ebaa542dcd9f166b05338acb13c4c757cff7bf13305be412b9617e127924c88

Comments