MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f27fba67b94771c756748795c1c3b89e66604c1a051fadd4a0a26afaf1dd6022. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f27fba67b94771c756748795c1c3b89e66604c1a051fadd4a0a26afaf1dd6022
SHA3-384 hash: af8a844f70ab29970aa99468293ad2e1567ee908f4dc77d25b699105060b36f7367593b325abef02baaba6be6af8aef8
SHA1 hash: bfdcd670baf53cb7a7673aaaffb00a7f6a60d6ef
MD5 hash: 027f98a3a90b3c26e2f60eb1bff7a9a8
humanhash: blue-berlin-diet-yankee
File name:1619693418.Vfc11I22caf2M75645.dynamene_Purchase Order89.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:686'092 bytes
First seen:2021-04-29 17:35:09 UTC
Last seen:2021-04-30 05:04:40 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:uobE8JkvIl0J/R+H8YPyh+m0/6yxm3yq8LFrL7uXn9Q0lF3H:l9kvIGJK0fCkiq8Jr+X9QkX
TLSH 55E4233ED18E12719266D63529B44698B3F7771E5438C8302EAFDE84C092E3E5C9366E
Reporter GovCERT_CH

Intelligence

File Origin
# of uploads :
2
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f27fba67b94771c756748795c1c3b89e66604c1a051fadd4a0a26afaf1dd6022/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-04-29 12:57:24 UTC
File Type:
Binary (Archive)
Extracted files:
38
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6j73uz5zi5y4ovtuq6k4dq5ytztgata2aup23vfaujvpv4o5mara._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210429-car7fejl92/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f27fba67b94771c756748795c1c3b89e66604c1a051fadd4a0a26afaf1dd6022

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz f27fba67b94771c756748795c1c3b89e66604c1a051fadd4a0a26afaf1dd6022

(this sample)

AgentTesla

Executable exe ab0ffcb1f044952bf2d71c463e4a2858905c974b6302cab8e8b29d81fc268def

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ab0ffcb1f044952bf2d71c463e4a2858905c974b6302cab8e8b29d81fc268def
  
Dropping
MD5 e866ca46f6ce4cb75fcf9470236b0b13

Comments