MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebee6aa23581694ef24a432fd0e09a5b150e9238f973ec62d182d6ca8c0b07e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ebee6aa23581694ef24a432fd0e09a5b150e9238f973ec62d182d6ca8c0b07e9
SHA3-384 hash: 5bd31a2342be65e8ac4b18c5c27d3ec9cb2cc9bdb440b9d3a8a5c3c28dcfb7a76ebb376305aa31d66c08c8bd5bb9cba1
SHA1 hash: c508bc265b17c20866bd73c16136bd4dd5cd2d1e
MD5 hash: 9f47d7fecb4794c475db8c10e2dfb22f
humanhash: hot-charlie-quebec-chicken
File name:Specifications_Details_20330_FLQ.lzh
Download: download sample
Signature AgentTesla
Create hunting rule
File size:639'656 bytes
First seen:2021-07-21 14:52:35 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:KoAo9FwTDq6S2vGziHlMnSH30uZlohbS6fhJnb7b5LuuII2CfD:KWfiD1JESXLI7nnb35KBS
TLSH T11CD423A120DF6FE48B895E13785FEB7F9803BFDAE031972445DAA89C79A5F0138D0590
Reporter cocaman
Tags:AgentTesla lzh rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ebee6aa23581694ef24a432fd0e09a5b150e9238f973ec62d182d6ca8c0b07e9/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2021-07-21 05:15:31 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
14 of 27 (51.85%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5pxgvirvqfuu54skimx5bye2lmkq5ery7fz6yywrqllmvdala7uq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence spyware stealer
Link:
https://tria.ge/reports/210721-6qbj4hkqge/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ebee6aa23581694ef24a432fd0e09a5b150e9238f973ec62d182d6ca8c0b07e9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ebee6aa23581694ef24a432fd0e09a5b150e9238f973ec62d182d6ca8c0b07e9

(this sample)

AgentTesla

Executable exe 41f206a7e8b3c15642e6cfad479ae3f0972b82e57ec46a5ffd31e51954a81c6c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 41f206a7e8b3c15642e6cfad479ae3f0972b82e57ec46a5ffd31e51954a81c6c

Comments