MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f148ae9882394ba9914ad7938329261f9b575e4dd613b347ca9b4b006e7ecd49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f148ae9882394ba9914ad7938329261f9b575e4dd613b347ca9b4b006e7ecd49
SHA3-384 hash: 7fb3d3fea50744f9235b700955a835f7d57fcdfb527910c0d30b55fb9c419fd81c4b5949342ed2894cb50f53180310cc
SHA1 hash: b4b4a08f8ad285e91a1940a70db3d030c54674e2
MD5 hash: 2ee420bce87603829fe7ee3268a8461e
humanhash: summer-aspen-video-missouri
File name:DDC payment.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:360'109 bytes
First seen:2022-06-10 01:56:26 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:fX+nWeUD6xsxFXoCjr0xycfhrKqh6oqD/NyZ+ZXohcRZ0fKKGU3tu+/ZyT6QFH:v+WeUuiX9cx/fxfh6hD/AAXz0fCU9u+Y
TLSH T1E47423572C678F172040B956A25FC76E5631F15B3822E28E214D9CB3ECFB39505AEE13
TrID 58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1)
41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:payment rar


Avatar
cocaman
Malicious email (T1566.001)
From: "cncaccounts@cncexp.cn <cncaccounts@cncexp.cn>" (likely spoofed)
Received: "from cncexp.cn (unknown [103.153.78.68]) "
Date: "9 Jun 2022 18:55:45 -0700"
Subject: "Re : FW : DDC payment for MATS8220051000 MATS7823685000"
Attachment: "DDC payment.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
352
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f148ae9882394ba9914ad7938329261f9b575e4dd613b347ca9b4b006e7ecd49/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-10 01:57:09 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
12 of 41 (29.27%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6fek5gechff2tekk26jygkjgd6nvoxsn2yj3gr6ktnfqa3t6zveq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220610-cc88haaha6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f148ae9882394ba9914ad7938329261f9b575e4dd613b347ca9b4b006e7ecd49

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f148ae9882394ba9914ad7938329261f9b575e4dd613b347ca9b4b006e7ecd49

(this sample)

AgentTesla

Executable exe 99dcc8fa5f3b1a9be8a0a70eb16a30bf06b8b0b618504b649470c7bdd87a5a5a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 99dcc8fa5f3b1a9be8a0a70eb16a30bf06b8b0b618504b649470c7bdd87a5a5a
  
Dropping
MD5 c0b1afb1c4a08919dcc1df352c880799

Comments