MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5194d56d24ac40c2a7baaddfdf34d79df14fc84f8c5b6cad05e0d6790d51560. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5194d56d24ac40c2a7baaddfdf34d79df14fc84f8c5b6cad05e0d6790d51560
SHA3-384 hash: bf13a16dbd3af7687eca99fa33ad6e6b71aef7424c0f2a6a104dbefcd3d8926c3df34bb971c60c37bef8264cf5f785fa
SHA1 hash: 6620be4635f20852b57c82ae0d74ed8df687a70c
MD5 hash: 1e5df6543d3bda96b2aa4c878579f300
humanhash: quiet-burger-west-steak
File name:HL-88352588 DOCAU BC ORIGINAL.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:711'982 bytes
First seen:2021-04-14 13:04:46 UTC
Last seen:2021-04-14 23:12:57 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:Dapxf8goUARU9BWk6L+gfkqZYEhTPdlY7p61zMvAl5kXouqR2XzDl6Za8zskbgts:QBCUAdpkMYEhTPHM61zrkXJqcX/Azzsw
TLSH C0E4337C7406E783AE57286D1F2FDEF706E0AAD8AF7EF9A05681D91B1C9618436700C4
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "QKLBOOK<QKLBOOK@hlag.com>" (likely spoofed)
Received: "from hlag.com (unknown [185.141.207.86]) "
Date: "14 Apr 2021 09:58:43 +0200"
Subject: "HL-88352629 DOCAU "
Attachment: "HL-88352588 DOCAU BC ORIGINAL.zip"

Intelligence

File Origin
# of uploads :
3
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.646-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/e5194d56d24ac40c2a7baaddfdf34d79df14fc84f8c5b6cad05e0d6790d51560
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e5194d56d24ac40c2a7baaddfdf34d79df14fc84f8c5b6cad05e0d6790d51560/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-14 13:07:08 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4umu2vwsjlcaykt3vlo7342nphprj7ee7dc3nswqlygwpegvcvqa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210414-wdv212y436/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e5194d56d24ac40c2a7baaddfdf34d79df14fc84f8c5b6cad05e0d6790d51560

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e5194d56d24ac40c2a7baaddfdf34d79df14fc84f8c5b6cad05e0d6790d51560

(this sample)

AgentTesla

Executable exe e70d1958db5ff44e5bbeb627b3baefcc79a153df4eb262cb9aef56c7ed555d75

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e70d1958db5ff44e5bbeb627b3baefcc79a153df4eb262cb9aef56c7ed555d75
  
Dropping
AgentTesla

Comments