MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04bbe3226291d664e7b63c276659a44f769b26c9d9e26176ffddb141c7239e93. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	04bbe3226291d664e7b63c276659a44f769b26c9d9e26176ffddb141c7239e93
SHA3-384 hash:	c08fee584af3e5313a9d79840b4bf16c644c57ff15a9c035f125f9a6e1bc46eb8bbc6016102e14866d971fa0188f364a
SHA1 hash:	e955898c6e50bd59960b88f690414519f483424a
MD5 hash:	16b8a8f44290e4f973fc5d3a5f704896
humanhash:	enemy-north-cup-eight
File name:	Huat Tradings - Products Inquiry.7z
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	7'665 bytes
First seen:	2022-11-11 10:27:48 UTC
Last seen:	2022-11-12 08:47:49 UTC
File type:	7z
MIME type:	application/x-rar
ssdeep	192:0vQ3HWrIItUrDBspzhKZSethLg7YhGG229Qiv8Rioa8:0Y3WzEexGLg0oGWivEioa8
TLSH	T19DF1A0B0EF47D826D37C58B3DC401B9420EB29614364058FB5DA76C7E72AF82F41A145
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	7z AgentTesla

cocaman

Malicious email (T1566.001)
From: ""Ken Lim"<sensor.service.la@datasensing.com>" (likely spoofed)
Received: "from [185.216.71.39] (unknown [185.216.71.39]) "
Date: "11 Nov 2022 23:57:48 +0100"
Subject: "Gin-Huat Tradings - Products Inquiry"
Attachment: "Huat Tradings - Products Inquiry.7z"

Intelligence

File Origin

# of uploads :

# of downloads :

141

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Huat Tradings - Products Inquiry.exe
File size:	171'520 bytes
SHA256 hash:	637e8dd8e33e243622620c997043180edcbd783a92dbd303b604a0708bae7d64
MD5 hash:	686469a54f61c3ef29681b63df9b0e31
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/636e23b382dd9f2e26538a3d/reports/7f2e559b-2d89-4b54-98ff-a4cfc9c8ec48/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/04bbe3226291d664e7b63c276659a44f769b26c9d9e26176ffddb141c7239e93/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-11-11 07:41:54 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

22 of 40 (55.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=as56gitcshlgjz5whqtwmwnej53jwjwj3hrgc5x73wyudrzdt2jq._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/221111-ml33yshd2y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/04bbe3226291d664e7b63c276659a44f769b26c9d9e26176ffddb141c7239e93

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.