MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34abfad52b6646b6f6347c7cb5bcc5faeac2543fc0ea1509e0d27a6664ba1a51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash:	34abfad52b6646b6f6347c7cb5bcc5faeac2543fc0ea1509e0d27a6664ba1a51
SHA3-384 hash:	116a7877ac10a83d9957fbe6f1b71ed5464975b7ae42b072b83732d4b44c0c088e2e8b33cea209bb307ac29e739f1f66
SHA1 hash:	61f021ea09d1c02b1cb7071d119e2e126520a5d5
MD5 hash:	c3a9e3e65586765c05d3154552a90258
humanhash:	august-white-lake-robin
File name:	Order_33849.img
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	61'440 bytes
First seen:	2022-10-31 14:09:57 UTC
Last seen:	2022-10-31 14:27:52 UTC
File type:	img
MIME type:	application/x-iso9660-image
ssdeep	384:sP0EWle+KWSLO9OJMCIIhptYcFmVc03K1:LHKWOWpktYcFmVc6K
TLSH	T15753F70593D00172EBB906763E67A7468737A29758BB56EE348C502F7F2369547233E0
TrID	99.6% (.NULL) null bytes (2048000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.ABR) Adobe PhotoShop Brush (1002/3) 0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter	cocaman
Tags:	AgentTesla img QUOTATION

cocaman

Malicious email (T1566.001)
From: "Indian Social Club, Sohar <isc.sohar@gmail.com>" (likely spoofed)
Received: "from gmail.com (unknown [45.137.22.61]) "
Date: "31 Oct 2022 05:38:23 +0100"
Subject: "Quotation Order _33849"
Attachment: "Order_33849.img"

Intelligence

File Origin

# of uploads :

# of downloads :

235

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Order_33849.exe
File size:	10'240 bytes
SHA256 hash:	cf1f377d2a4f59a5c6e94629e07f57ac5cf952a880ef3f02c5714a4890b4a695
MD5 hash:	63e1bd0e1d54d20da7c87c8f1a1fc1ec
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Rogue.0hr.20221030-2341.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

context-iso packed

Link:

https://www.filescan.io/uploads/635fd73f58409ff7bc0c6117/reports/b8790fcc-8183-4763-bbf0-59e9177f4161/overview

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/34abfad52b6646b6f6347c7cb5bcc5faeac2543fc0ea1509e0d27a6664ba1a51/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-10-30 22:00:37 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 41 (41.46%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=gsv7vvjlmzdln5rupr6llpgf7lvmevb7ydvbkcpa2j5gmzf2djiq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/34abfad52b6646b6f6347c7cb5bcc5faeac2543fc0ea1509e0d27a6664ba1a51

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_VBS_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contain VBS functions
Reference:	Internal Research