MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4f8bebc44774935d1a410f26d820c700368211e21ef6320226fa06a9e893254. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4f8bebc44774935d1a410f26d820c700368211e21ef6320226fa06a9e893254
SHA3-384 hash: a575cef1f312cba16447c31f3f46c2016889d07695ab089c32dba712e1899671fa9eed08b2852ae6b678db632653b113
SHA1 hash: 369cacb9e0bec28452f4bc7a2e06b0260bfcf8a5
MD5 hash: cc84f5ad38c51ba23e59aab7ec732f69
humanhash: fruit-alpha-tango-winner
File name:TOP URGENT PDF.TAR
Download: download sample
Signature AgentTesla
Create hunting rule
File size:562'215 bytes
First seen:2021-09-15 14:03:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:xSB9sGVL2TI+/MFOtSk3PpBvbl1x7aWNFXi2g1v8uNgz3xwdU:3GVLQrwkRdl7aWbilvfgzxwS
TLSH T19BC42381701887F4742E678CAEAC8891C85F342165A7EC79B6C89CFB640CA6FD3DBD54
Reporter cocaman
Tags:AgentTesla rar tar


Avatar
cocaman
Malicious email (T1566.001)
From: "IT support allsport.ch <administrator@allsport.ch>" (likely spoofed)
Received: "from mta0.nomadfortmcmuurray.com (unknown [165.232.136.1]) "
Date: "15 Sep 2021 13:56:15 +0200"
Subject: "allsport.ch <administrator@allsport.ch>"
Attachment: "TOP URGENT PDF.TAR"

Intelligence

File Origin
# of uploads :
1
# of downloads :
238
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61751b289a5a1e91c5d203b1/reports/a008f2c3-ed21-4bd8-8f16-73e0f8dd83bd/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e4f8bebc44774935d1a410f26d820c700368211e21ef6320226fa06a9e893254/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2021-09-15 11:19:54 UTC
File Type:
Binary (Archive)
Extracted files:
31
AV detection:
6 of 45 (13.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4t4l5pceo5etlunecdzg3aqmoabwqii6ehxwgibcn6qgvhujgjka._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210915-rcpw7aagd6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e4f8bebc44774935d1a410f26d820c700368211e21ef6320226fa06a9e893254

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e4f8bebc44774935d1a410f26d820c700368211e21ef6320226fa06a9e893254

(this sample)

AgentTesla

Executable exe c810e257ac876cb505d076efee941037f5f9fd11464a4af8515d0fbac61509b1

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c810e257ac876cb505d076efee941037f5f9fd11464a4af8515d0fbac61509b1
  
Dropping
AgentTesla

Comments