MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0739ebe309bb5e551728cc17dc4720d5952db5cb085907cbb1401e9e2165ae5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 4 File information Comments

SHA256 hash:	0739ebe309bb5e551728cc17dc4720d5952db5cb085907cbb1401e9e2165ae5f
SHA3-384 hash:	dfbaac58a604bbb4e8abb0c12bb8c33965aaf390714c7a19ada08854835aceea4bd0dba54e8a6433156500db96fb0325
SHA1 hash:	ba8b2481796f753eaa5d87b30cc19b0fc002c002
MD5 hash:	9223d096345ec839f7fef6c30e90f052
humanhash:	mobile-mike-hawaii-shade
File name:	RE KRMU6644555 - TUTICORIN _YMHG 4th PO#QSB-180211, QSB-1802102 & GSB-18021992 .pdf.rar
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	556'872 bytes
First seen:	2023-05-09 11:35:31 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:44AcJihO5xjr+0rNH2WQshXJSGdd/0DyMpbFSmVc22:44A8MO59qUImYGdCyMV52
TLSH	T18BC423645074C7A80EFB15C02F4ADF418B8D64B95765A562E4A9E3CF1F1802F3AFDA34
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla rar

cocaman

Malicious email (T1566.001)
From: "Sylvia Artur<finance_my@unigreating.com.cn>" (likely spoofed)
Received: "from unigreating.com.cn (unknown [45.137.22.109]) "
Date: "9 May 2023 13:31:34 +0200"
Subject: "=?UTF-8?B?5o+Q6LSnIOWbnuWkjTogUkU6IEtSTVU2NjQ0NTUvNSAtIFRVVElDT1JJTiBfWU1IRyAvLyA0dGggUE8jUVNCLTE4MDIxMSwgUVNCLTE4MDIxMDIgJiBHU0ItMTgwMjE5OTIg?="
Attachment: "RE KRMU6644555 - TUTICORIN _YMHG 4th PO#QSB-180211, QSB-1802102 & GSB-18021992 .pdf.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	RE KRMU6644555 - TUTICORIN _YMHG 4th PO#QSB-180211, QSB-1802102 & GSB-18021992 .pdf.exe
File size:	626'176 bytes
SHA256 hash:	d46e1ec4fd88c836e0f27060808c2506e0df5d1034f9c88e56dd37bfc2113120
MD5 hash:	beaa0809a41f302ef5fe63f8ff33dc7c
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/0739ebe309bb5e551728cc17dc4720d5952db5cb085907cbb1401e9e2165ae5f/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

comodo jigsaw packed

Link:

https://www.filescan.io/uploads/645a3023b664422b69d5fbf1/reports/117bd62f-d09f-416c-b2b6-caf4d1213dc6/overview

Verdict:

Malicious

Labled as:

HIDDENEXT/Worm.Generic

Link:

https://www.hybrid-analysis.com/sample/0739ebe309bb5e551728cc17dc4720d5952db5cb085907cbb1401e9e2165ae5f

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0739ebe309bb5e551728cc17dc4720d5952db5cb085907cbb1401e9e2165ae5f/

Threat name:

ByteCode-MSIL.Trojan.SnakeKeylogger

Status:

Malicious

First seen:

2023-05-09 08:56:59 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=a446xyyjxnpfkfzizql5yrza2wks3nolbbmqps5riapj4ilfvzpq._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230509-tmc2gsef8s/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Malware Config

C2 Extraction:

https://api.telegram.org/bot5494052141:AAF2aO4sQ_tu4BOnk0pmxB995km7Mslduy0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0739ebe309bb5e551728cc17dc4720d5952db5cb085907cbb1401e9e2165ae5f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4 Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research