MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd0c218d24dea59dbd62eb5041aaa24dc0c34a6ae0ccea288f496eda3732bbe3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd0c218d24dea59dbd62eb5041aaa24dc0c34a6ae0ccea288f496eda3732bbe3
SHA3-384 hash: 46bc1e053a967bf4a3e0be4cfd5e22ef615c3231b44b07919ba9dd8c6c7ad2bcd4fa24a9831b8208ebae13a4cb439774
SHA1 hash: 2fa3e8ef4cf9d96e7adeeec8f7a9ea3a5c23b442
MD5 hash: 9f2019ff734e0b7c257a3727abe61a7b
humanhash: november-hydrogen-sodium-dakota
File name:proforma invoice TRKINV2021000000000003005 TT Slip copy.r17
Download: download sample
Signature AgentTesla
Create hunting rule
File size:277'061 bytes
First seen:2021-05-31 06:53:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Cah9SCR8BHLR+RwB6uqWO8o6fEFgboi0gDwArMtOy:f9SM8BrR+CB9O/eagboivweMP
TLSH 174423F88B3AE16D843D8930A443E798115C8D8F4B358CC766847EEDA9977A60CCD4DB
Reporter cocaman
Tags:AgentTesla INVOICE r17 rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Basem Shaban"<Battia@hydrotech-eg.com>" (likely spoofed)
Received: "from hydrotech-eg.com (unknown [203.159.80.83]) "
Date: "31 May 2021 06:03:57 +0200"
Subject: "FW: AW: Egyption Arab Contracting INVOICE REQUEST 3301 - TOP URGENT-"
Attachment: "proforma invoice TRKINV2021000000000003005 TT Slip copy.r17"

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd0c218d24dea59dbd62eb5041aaa24dc0c34a6ae0ccea288f496eda3732bbe3/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-31 02:55:46 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ugcddje32sz3plc5niedkvcjxamgstk4dgoukepjfxnunzsxprq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/210531-p3h7fzrnkj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fd0c218d24dea59dbd62eb5041aaa24dc0c34a6ae0ccea288f496eda3732bbe3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar fd0c218d24dea59dbd62eb5041aaa24dc0c34a6ae0ccea288f496eda3732bbe3

(this sample)

AgentTesla

Executable exe 52906a1cd3e2b1b5728deaf7842ebd70313d6e4bef0c4d5ddd0ad8245176a904

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 52906a1cd3e2b1b5728deaf7842ebd70313d6e4bef0c4d5ddd0ad8245176a904
  
Dropping
AgentTesla

Comments