MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc5c0a283ea758db16ba8d81b308c598b55c7911b3003615d607daf3a8540e24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc5c0a283ea758db16ba8d81b308c598b55c7911b3003615d607daf3a8540e24
SHA3-384 hash: 1af83aab568784936c5b88e3e01990841b2d145083715fbb4a0a11d118f5a886bb38c09bbed7ee148477b2057423b15c
SHA1 hash: 7164d9699d3450d8198dfb2eba156dfb44f54cde
MD5 hash: 3666d6a34e9557d93b45fe392dfdad5d
humanhash: neptune-fish-bakerloo-cup
File name:HSBC SWIFT REMITTANCE ADVICE.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:507'334 bytes
First seen:2022-10-19 07:23:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:nP+6rg0hk5Hm3EZ3DTLFWpW9J+57KFt2Xt/DfUN6E5gY1q/CHxRi:PHhktm3EZfL/99z2XJfkXg/ui
TLSH T18CB42385518F713BBCBD20D44A9D90320D2D8EBF3D858E5A1FD99BC062734B9CA1E978
TrID 58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1)
41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:AgentTesla HSBC payment rar SWIFT


Avatar
cocaman
Malicious email (T1566.001)
From: "Veronica Liu - Accounts<admin@r0bonaticsservice.gq>" (likely spoofed)
Received: "from r0bonaticsservice.gq (unknown [180.214.238.231]) "
Date: "18 Oct 2022 16:48:47 -0700"
Subject: "Remittance advice for payment"
Attachment: "HSBC SWIFT REMITTANCE ADVICE.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
n/a
File Archive Information

This file archive contains 11 file(s), sorted by their relevance:

File name:version.txt
File size:1'654 bytes
SHA256 hash: 548781e24ca8f248707843427d1c752f408f3b446d0bcb92c8a244f2ff51717b
MD5 hash: 5b72ad94d0cf43051f608bcf3e376db3
MIME type:application/octet-stream
Signature AgentTesla
File name:9.ico
File size:1'150 bytes
SHA256 hash: e816d1746171869153ee0991abb83b567a51c84ef0f349167607cd96948eb0ee
MD5 hash: dd39fc455bde8f14048ee4a2bd7e0cf3
MIME type:image/vnd.microsoft.icon
Signature AgentTesla
File name:2.ico
File size:67'646 bytes
SHA256 hash: 55227de40607c3819d291120c6d41890a0750bee4f8f0b8e19da64385f9b96a8
MD5 hash: 1e65ca3b21a47652cffdae6c3866b110
MIME type:image/vnd.microsoft.icon
Signature AgentTesla
File name:6.ico
File size:9'662 bytes
SHA256 hash: 868567c0e4127d381d69d917bfad6f9697e6ec338c3f9cfe46a9c78a6f083c93
MD5 hash: f401529c98c77eba60c58a9ba7d44e97
MIME type:image/vnd.microsoft.icon
Signature AgentTesla
File name:3.ico
File size:38'078 bytes
SHA256 hash: ba7944ac92f915d2df77e92714d662033e9366068adb4ff3a96e029d41edf15f
MD5 hash: f724edd21ba3c939ebb178fa6d98efe2
MIME type:image/vnd.microsoft.icon
Signature AgentTesla
File name:5.ico
File size:16'958 bytes
SHA256 hash: 4db40a5033656c99c451f13927a267c4ccfde741a81e342fc7f394aa6ebc5588
MD5 hash: 2d3325de6319820d0d866f7e458f9b87
MIME type:image/vnd.microsoft.icon
Signature AgentTesla
File name:8.ico
File size:2'462 bytes
SHA256 hash: 7867f66b081a41a83d4cc8b267960d5db5707461135198f55ad243c45db8dc3c
MD5 hash: 55936c3f8a70b7caba52e0705d17964e
MIME type:image/vnd.microsoft.icon
Signature AgentTesla
File name:1
File size:132 bytes
SHA256 hash: f1d064aa564fecb6774a65a2cefe7cadbb445fb7df2c5c99ec112e1078ad2042
MD5 hash: a91e648167a611d84d37421ab37f3efe
MIME type:application/octet-stream
Signature AgentTesla
File name:4.ico
File size:21'662 bytes
SHA256 hash: 81a5dca67e18c6c15f13b9bc9728749714dca9edae84dd0567c1f0f5476b8d1a
MD5 hash: 4d1ffd7ae8c40de9644aadc400333487
MIME type:image/vnd.microsoft.icon
Signature AgentTesla
File name:32512
File size:20 bytes
SHA256 hash: 808087df126c8c61cd3d908523ea0f1b7a1b5d9e0cece2c7e7b06cbd1c9ed9da
MD5 hash: d24a8e63c78b1f125fbde9780530b06c
MIME type:application/octet-stream
Signature AgentTesla
File name:7.ico
File size:4'286 bytes
SHA256 hash: b3043d30f0824f59485e0274a430c5fcc82999c0e70103d74935377d5f095bb3
MD5 hash: a51f1bcf575b6765dc756bef09942979
MIME type:image/vnd.microsoft.icon
Signature AgentTesla
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/634fa614898b0652a4b8ee44/reports/5b69379b-49f5-47bb-b613-04b6313ed177/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fc5c0a283ea758db16ba8d81b308c598b55c7911b3003615d607daf3a8540e24/
Threat name:
ByteCode-MSIL.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-10-18 02:43:24 UTC
File Type:
Binary (Archive)
Extracted files:
39
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7roaukb6u5mnwfv2rwa3gcgftc2vy6irwmadmfowa7nphkcubysa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/221019-h8dpcsfehk/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Drops file in Drivers directory
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fc5c0a283ea758db16ba8d81b308c598b55c7911b3003615d607daf3a8540e24

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar fc5c0a283ea758db16ba8d81b308c598b55c7911b3003615d607daf3a8540e24

(this sample)

AgentTesla

Executable exe 3f77323ca44e9fdb70ea05be1bc7814ed7ae78be087363619a2f6bef4bb9bff9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3f77323ca44e9fdb70ea05be1bc7814ed7ae78be087363619a2f6bef4bb9bff9
  
Dropping
AgentTesla

Comments