MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9ce0de4f3072ba576d7e99abd87e9c7efa1d30ec78c4de3ff2e257094e257a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9ce0de4f3072ba576d7e99abd87e9c7efa1d30ec78c4de3ff2e257094e257a0
SHA3-384 hash: 47e128fe39487147e91dff8b606e87cde28085be3c97c78f3a220f97a06819d4401f043b10703264d1d119845e4790d9
SHA1 hash: d4c9d73cc2f051b9918910c08ab0c138cdbccc64
MD5 hash: 3108065b6c0d8f58d618b2d171cfb09f
humanhash: purple-single-lamp-angel
File name:REMITANCE COPY.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:518'030 bytes
First seen:2022-06-29 08:32:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:02irMsppVYkRHmrQdle0bfuybIU9RdgyoauI7eQCaBejXsQFVbvKxjS:6YFkRHDfuyt9Iyo1pra2c05vKRS
TLSH T1A2B4230BBD89CC77D3092096890BA15B45A540E03BB8F44D0768376E68C6F1BFB5963B
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla payment zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Wang weishun<weishun@hoscoagency.com>" (likely spoofed)
Received: "from hoscoagency.com (unknown [45.137.22.120]) "
Date: "29 Jun 2022 10:32:00 +0200"
Subject: "RE:RE:RE:PAYMENT ADVISE(103) TT/USD/8145/2020 "
Attachment: "REMITANCE COPY.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62bc0e4d114aa383d0ec132c/reports/7a7509b8-2a2c-4a4a-b035-e6676322f771/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/e9ce0de4f3072ba576d7e99abd87e9c7efa1d30ec78c4de3ff2e257094e257a0
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e9ce0de4f3072ba576d7e99abd87e9c7efa1d30ec78c4de3ff2e257094e257a0/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-29 08:33:18 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5hha3zhta4v2k5wx5gnl3b7jy7x2duyoy6ge3y77fysxbfhck6qa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220629-kfxb4sgbdm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Drops file in Drivers directory
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5227573794:AAECZBnQSxLs0aOVsV2wnclC6-WKnxPpi_k/sendDocument
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e9ce0de4f3072ba576d7e99abd87e9c7efa1d30ec78c4de3ff2e257094e257a0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e9ce0de4f3072ba576d7e99abd87e9c7efa1d30ec78c4de3ff2e257094e257a0

(this sample)

AgentTesla

Executable exe 22788a868660104a0adcca5b04aad0849615b4d9f22c277ac23dd9aa79d385fc

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 22788a868660104a0adcca5b04aad0849615b4d9f22c277ac23dd9aa79d385fc
  
Dropping
AgentTesla

Comments