MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc22d2993f9ab652ce83aa6cd050c027c68d2b756d9dff54dd6e0d9cbdd832d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc22d2993f9ab652ce83aa6cd050c027c68d2b756d9dff54dd6e0d9cbdd832d9
SHA3-384 hash: cbda025cf32431873d74ec91335e6a49aa82bf54557c562ba48b5accc5ee987c02dd28769016619e34e9491c4befa513
SHA1 hash: c497cec42fa155ee9ac7dde719ee5f4a59ec3ba8
MD5 hash: 2b87b75f79972bfde1b9cb25661f5c2e
humanhash: steak-vermont-foxtrot-paris
File name:Invoice86.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:813'661 bytes
First seen:2021-05-14 05:49:36 UTC
Last seen:2021-05-14 06:02:45 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:Ii7P6/w/JU2QIzeTu6EfUiA3Bp1pQjz6t6Os1Nq7i0gygwzW4DkXT9oBwv:lr6/xq6EfRUp1pEzOs1ERS4DkXCBA
TLSH 22053372E105F61108992AE108BD7B4334E1CB7FC470D9DA8AAE8A521667FC83D95F78
Reporter cocaman
Tags:DHL INVOICE zip


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL Express <dhlsender@dhl.com" (likely spoofed)
Received: "from [31.210.21.39] (unknown [31.210.21.39]) "
Date: "14 May 2021 00:06:57 +0200"
Subject: "DHL Express Confirmation address"
Attachment: "Invoice86.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn25.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Scr.Malcodegdn30.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21103.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/fc22d2993f9ab652ce83aa6cd050c027c68d2b756d9dff54dd6e0d9cbdd832d9
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fc22d2993f9ab652ce83aa6cd050c027c68d2b756d9dff54dd6e0d9cbdd832d9/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-05-13 11:25:36 UTC
File Type:
Binary (Archive)
Extracted files:
148
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7qrnfgj7tk3fftudvjwnaugae7di2k3vnwo76vg5nygzzpoyglmq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210514-3lw8fxy7wx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fc22d2993f9ab652ce83aa6cd050c027c68d2b756d9dff54dd6e0d9cbdd832d9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip fc22d2993f9ab652ce83aa6cd050c027c68d2b756d9dff54dd6e0d9cbdd832d9

(this sample)

AgentTesla

Executable exe bcad50b3c7baf6c886b6a97aacdc8639c524d652b4ebc683fc871518f4afdbd8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bcad50b3c7baf6c886b6a97aacdc8639c524d652b4ebc683fc871518f4afdbd8

Comments