MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fcd73b835294b1c2f2ab33f93b4e8de15896dcaa7d74dfbe081c136138eeb358. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fcd73b835294b1c2f2ab33f93b4e8de15896dcaa7d74dfbe081c136138eeb358
SHA3-384 hash: ac8f073fe1a6ed2de44bd03210bcb78b665d5c7bca36f0516dd38ca2b1488ac7f6c721b43e8f64f24d4e14cdb73eb5b4
SHA1 hash: 7f84ae84132ce436abf434ed5f7c4c9b663ce5b0
MD5 hash: 495c93caeb705ccee10c79ea6e100398
humanhash: chicken-mike-spaghetti-hawaii
File name:PRE SHIPPING NOTICE.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:434'135 bytes
First seen:2022-11-22 13:32:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:DtTbDKSnr3AAt7DWKIu5CNRntEAAMJ9BWZee:DxHKSnb5tfWKImLU9Bw
TLSH T1E29423AC0F7836D9D7A8CDD7500AE53201606E3C3DF1EDB1D2D46A9A9DD24C6D223AE4
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla Shipping zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Mrong, Monir<monir.mrong@wx8.mxzm.live>" (likely spoofed)
Received: "from hp0.wx8.mxzm.live (unknown [159.203.7.65]) "
Date: "22 Nov 2022 14:16:16 +0100"
Subject: "RE: Shipment advice 269 for the C/nee Fussl // Ex. BDCGP to DEHAM"
Attachment: "PRE SHIPPING NOTICE.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:PRE SHIPPING NOTICE.exe
File size:503'808 bytes
SHA256 hash: b0de009900f1adb09751869dba25290ec1f2d7e197f9b15c6313273b4e8f4c2a
MD5 hash: c35f51b23d7f748792a4b9f35d6f3c03
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1680.21637.7137.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/637ccf90a0efd596b82f1ced/reports/a5e6305a-1037-4a7e-9316-c4fc9f04f107/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/fcd73b835294b1c2f2ab33f93b4e8de15896dcaa7d74dfbe081c136138eeb358
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fcd73b835294b1c2f2ab33f93b4e8de15896dcaa7d74dfbe081c136138eeb358/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-11-22 08:38:09 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
19 of 41 (46.34%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7tltxa2sssy4f4vlgp4twtun4fmjnxfkpv2n7pqidqjwcohownma._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/221122-q3h1wsed92/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5515611206:AAEcQSX8hXHOAxSYr8KUdLxGF5eqw4FRXoA/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/fcd73b835294b1c2f2ab33f93b4e8de15896dcaa7d74dfbe081c136138eeb358

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip fcd73b835294b1c2f2ab33f93b4e8de15896dcaa7d74dfbe081c136138eeb358

(this sample)

AgentTesla

Executable exe b0de009900f1adb09751869dba25290ec1f2d7e197f9b15c6313273b4e8f4c2a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b0de009900f1adb09751869dba25290ec1f2d7e197f9b15c6313273b4e8f4c2a

Comments