MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36bdfc767fa58a1f34fc6f55ab7d48a9d54d696ac1ba1e3a96b0f64f0e7df7cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36bdfc767fa58a1f34fc6f55ab7d48a9d54d696ac1ba1e3a96b0f64f0e7df7cf
SHA3-384 hash: a11c67c3ac9b37cbf0a6c1e43d61795987a1831e8be652e78875c2ee0128ca2ea28d979031f282dc5a6666d2e11751d7
SHA1 hash: 2e25af7453e77e11acbd6948ec540cbca1bed5d5
MD5 hash: cbce1f17694102e7210b93ba375f8be9
humanhash: foxtrot-sierra-shade-steak
File name:QUOTATION NEW.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:689'475 bytes
First seen:2023-12-15 10:28:20 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:GrOk+lWjnxl0lse5NC/+EU++vSfJMnTZ4RjxzOUlULX6gpNNDN87:GVcWjnxl0ee5NCGGfJiTZwjZOwEvj87
TLSH T1BAE423106ACE6282F8F42277127390BE687F73104D566615FFE9BD614EA932A301BDF4
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla QUOTATION zip


Avatar
cocaman
Malicious email (T1566.001)
From: "J. Erhardt | GmbH.<info@stefanakiscs.gr>" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.107]) "
Date: "14 Dec 2023 20:06:02 +0100"
Subject: "AW: Re:Re: Angebot Harbin Spring PO-1700101223 rev-1"
Attachment: "QUOTATION NEW.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:QUOTATION NEW.exe
File size:849'408 bytes
SHA256 hash: 864fe98f784db801dd8514226f5b70bb21f41ef4ffcef3fc77636fbfa039444a
MD5 hash: b2d9972df6a83648f2ff0a05d8197639
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2022.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Win32.PWSX-gen.32708.16073.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/657c2a6eb4e856b7281abd55/reports/ace84114-d018-4902-bc3a-a1b750fd6f45/overview
Verdict:
Malicious
Labled as:
Troj/MSIL
Link:
https://www.hybrid-analysis.com/sample/36bdfc767fa58a1f34fc6f55ab7d48a9d54d696ac1ba1e3a96b0f64f0e7df7cf
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/36bdfc767fa58a1f34fc6f55ab7d48a9d54d696ac1ba1e3a96b0f64f0e7df7cf
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Score:
100%
Verdict:
Malware
File Type:
Archive
Link:
https://malprob.io/report/36bdfc767fa58a1f34fc6f55ab7d48a9d54d696ac1ba1e3a96b0f64f0e7df7cf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36bdfc767fa58a1f34fc6f55ab7d48a9d54d696ac1ba1e3a96b0f64f0e7df7cf/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-12-14 15:03:19 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
21 of 36 (58.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g267y5t7uwfb6nh4n5k2w7kivhku22lkyg5b4ouwwd3e6dt567hq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/231215-snfy4adfdk/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/36bdfc767fa58a1f34fc6f55ab7d48a9d54d696ac1ba1e3a96b0f64f0e7df7cf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 36bdfc767fa58a1f34fc6f55ab7d48a9d54d696ac1ba1e3a96b0f64f0e7df7cf

(this sample)

AgentTesla

Executable exe 864fe98f784db801dd8514226f5b70bb21f41ef4ffcef3fc77636fbfa039444a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 864fe98f784db801dd8514226f5b70bb21f41ef4ffcef3fc77636fbfa039444a
  
Dropping
AgentTesla

Comments