MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f450126e36db8236a9dc2339c3f87e4e2dc14e2a3a21dda89bf65ef678a50229. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f450126e36db8236a9dc2339c3f87e4e2dc14e2a3a21dda89bf65ef678a50229
SHA3-384 hash: f2f0a6375526a6e8f8870cbcaf82378b3f4b465481b6b5c2e6b57f63fafba25d1d0d9f0520383b214bec60ef26f54f87
SHA1 hash: 03dfe84384131762538747faffe8e866dc7a56e9
MD5 hash: 3475d4431afcd9c6262eff9ea2158f0c
humanhash: maine-indigo-undress-diet
File name:PO121879.r13
Download: download sample
Signature AgentTesla
Create hunting rule
File size:534'527 bytes
First seen:2022-04-29 06:11:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:ofnD4b+T8dv5IpAxnc5+EvzP/NFEa/4v5aYsjE0T/:o74b+IdvISO+EbP3Ea/+a7Aa
TLSH T12EB4230B68F5D389B7279416CB657FD99840D06372C3B812E1CC5B8A11BFAD92F29932
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:AgentTesla r13 rar


Avatar
cocaman
Malicious email (T1566.001)
From: "fajar@combilogistics.co.id" (likely spoofed)
Received: "from combilogistics.co.id (unknown [185.222.57.233]) "
Date: "22 Apr 2022 12:28:30 +0200"
Subject: "PO121879"
Attachment: "PO121879.r13"

Intelligence

File Origin
# of uploads :
1
# of downloads :
191
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed update.exe
Link:
https://www.filescan.io/uploads/626b81b20749328a03d1f4f5/reports/58fea9ac-57b6-41af-9d52-290fe32598e9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f450126e36db8236a9dc2339c3f87e4e2dc14e2a3a21dda89bf65ef678a50229/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-22 09:35:59 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
24 of 42 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ribe3rw3obdnko4em44h6d6jyw4ctrkhiq53ke36zppm6ffaiuq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220429-gx6ekaghh8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f450126e36db8236a9dc2339c3f87e4e2dc14e2a3a21dda89bf65ef678a50229

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f450126e36db8236a9dc2339c3f87e4e2dc14e2a3a21dda89bf65ef678a50229

(this sample)

AgentTesla

Executable exe 38ca85dce6d78cd31902c6f56c2a8972b0d7d7425c584c98b3210a5c75e3c84a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 38ca85dce6d78cd31902c6f56c2a8972b0d7d7425c584c98b3210a5c75e3c84a
  
Dropping
AgentTesla

Comments