MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f571f7513266795c724c87b33f3e388e83e258903a35bd9d64bfa052ed1b79dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f571f7513266795c724c87b33f3e388e83e258903a35bd9d64bfa052ed1b79dc
SHA3-384 hash: 9751731e4a52ee993e26796a668c9cadc25b10e78c0d4dd5ed6fc5536fbf465b80e5d7eb8c909e0e2720078bcf969776
SHA1 hash: b3adc7973cb97b6b9405265146b25e20d716715f
MD5 hash: 37152cdcfa597adaec04a48c5c728179
humanhash: georgia-rugby-massachusetts-lion
File name:_ARIX SRLVl (MN) - Italy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:549'912 bytes
First seen:2021-04-26 10:05:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:AMXkyHRv6gXWi51J0ecl7UAA3GPv3sWzgWbOxlOqE1nXdBQDLkw:AQkyH971VcWVGn3s5xlW1ntBQkw
TLSH 4FC423150D293EEA9E8E0DBEBEC12B2E5C31EC03F0CA1AC911A676BA10514F56757F58
Reporter GovCERT_CH

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.680.31223.27008.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/f571f7513266795c724c87b33f3e388e83e258903a35bd9d64bfa052ed1b79dc
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f571f7513266795c724c87b33f3e388e83e258903a35bd9d64bfa052ed1b79dc/
Threat name:
ByteCode-MSIL.Infostealer.Coins
Create hunting rule
Status:
Malicious
First seen:
2021-04-26 00:23:18 UTC
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6vy7oujsmz4vy4smq6zt6pryr2b6eweqhi233hlex6qff3i3phoa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210426-ghcqxjpbjx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/f571f7513266795c724c87b33f3e388e83e258903a35bd9d64bfa052ed1b79dc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f571f7513266795c724c87b33f3e388e83e258903a35bd9d64bfa052ed1b79dc

(this sample)

AgentTesla

Executable exe 2adae9b6592e71484038a7aff96306b4761fefe3f7bd7163e6bcba18c3427dd3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2adae9b6592e71484038a7aff96306b4761fefe3f7bd7163e6bcba18c3427dd3
  
Dropping
MD5 c1aac28d8d00d44f8c3059d6a1aa397b

Comments