MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3dbd53a7626f27b98eabb7aa8c42ffdcd5b93a382bf74476a05e94f20022160. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f3dbd53a7626f27b98eabb7aa8c42ffdcd5b93a382bf74476a05e94f20022160
SHA3-384 hash: 6c956b8c1bd2e59c11ad77e0b4a6d8f4426b976e55023ff16adcdb258b86c65611b946d9090392b483f5dcaae3aadfa8
SHA1 hash: ac76df964db44409647a65b39beac64bfdee39e3
MD5 hash: 136240e2c13cb1aefb92c7b2896d45a6
humanhash: california-august-oscar-oxygen
File name:FDA.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:658'676 bytes
First seen:2024-04-29 12:11:57 UTC
Last seen:2024-04-30 07:17:22 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:nYTosT8xkiEVlzOiLQWEfkPcY4tpfaVHMPHaBcAB2PILQzQ3bjjgtbXVxPnDLSC7:nY8rslz7LOkPetFaVsP6Bd2qsQ3jyrzB
TLSH T144E4233A720C7E05F3366EC602669499C71EF0ECA1C68B813193DFA2973E61B0545BB7
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla Shipping zip


Avatar
cocaman
Malicious email (T1566.001)
From: "SHIPPING AGENCY <operation@ssagency.id>" (likely spoofed)
Received: "from ssagency.id (unknown [185.222.58.235]) "
Date: "29 Apr 2024 21:46:36 +0200"
Subject: "Prefunding and remittance details"
Attachment: "FDA.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
287
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:FDA.exe
File size:687'624 bytes
SHA256 hash: 5d2b78785f719fda04cda095b4dfb75d00440fc39ab6e52d176a74786541bdaf
MD5 hash: fd9af8f629d0d2e3e8cc132cdff97497
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/f3dbd53a7626f27b98eabb7aa8c42ffdcd5b93a382bf74476a05e94f20022160/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/662f8e9954bafb7d21e5e3b6/reports/33482a0e-4ad3-4991-8b0a-e130ae7e6d86/overview
Verdict:
Suspicious
Labled as:
Troj/Krypt
Link:
https://www.hybrid-analysis.com/sample/f3dbd53a7626f27b98eabb7aa8c42ffdcd5b93a382bf74476a05e94f20022160
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/f3dbd53a7626f27b98eabb7aa8c42ffdcd5b93a382bf74476a05e94f20022160
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f3dbd53a7626f27b98eabb7aa8c42ffdcd5b93a382bf74476a05e94f20022160/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2024-04-29 05:47:59 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6pn5kotwe3zhxghkxn5krrbp7xgvxe5dqk7xir3kaxuu6iacefqa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/240429-qms6xsbh51/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f3dbd53a7626f27b98eabb7aa8c42ffdcd5b93a382bf74476a05e94f20022160

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f3dbd53a7626f27b98eabb7aa8c42ffdcd5b93a382bf74476a05e94f20022160

(this sample)

AgentTesla

Executable exe 5d2b78785f719fda04cda095b4dfb75d00440fc39ab6e52d176a74786541bdaf

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5d2b78785f719fda04cda095b4dfb75d00440fc39ab6e52d176a74786541bdaf
  
Dropping
AgentTesla

Comments