MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b84acfb0076055b0be8086d2f256ea7bcebc0ce0231b003b3ac263ee59303f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	3b84acfb0076055b0be8086d2f256ea7bcebc0ce0231b003b3ac263ee59303f0
SHA3-384 hash:	c31631f32cefdbc7524a2ab77d13cf403216f0837a6f40775852dbdaf48b08b108888c28a83912d2672c1ba7a1eff882
SHA1 hash:	fa0d11b2370187c4c39e8fd47c187276616d2a23
MD5 hash:	1e70b8b122ad1a4624461d753b8b62dd
humanhash:	saturn-finch-tango-mango
File name:	RFQ REF R2100131410.pdf.7z
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	544'574 bytes
First seen:	2021-10-11 12:51:55 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-rar
ssdeep	12288:NFq9KziKHevW7ITywZSWyENlCr3ez3eTyfqQHlmRGWOu:u9ciK8FTyBErEuzuIm8WB
TLSH	T149C423A616F97376DE323E6B23A96B8F5CE3DF0F544ADBDC05850DA623450D70E21888
Reporter	cocaman
Tags:	7z AgentTesla

cocaman

Malicious email (T1566.001)
From: "Daiyu Baozhai <info@shipplate.com>" (likely spoofed)
Received: "from shipplate.com (unknown [195.133.18.123]) "
Date: "11 Oct 2021 05:23:20 +0200"
Subject: "REQUEST FOR QUOTATION (RFQ REF : R2100131410)"
Attachment: "RFQ REF R2100131410.pdf.7z"

Intelligence

File Origin

# of uploads :

# of downloads :

157

Origin country :

n/a

Vendor Threat Intelligence

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware obfuscated packed

Link:

https://www.filescan.io/uploads/61643375fd35fe780c380446/reports/4614c8c4-98d3-44f4-8915-f5faa39bf1c6/overview

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3b84acfb0076055b0be8086d2f256ea7bcebc0ce0231b003b3ac263ee59303f0/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-10-11 03:18:39 UTC

AV detection:

14 of 45 (31.11%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hockz6yaoycvwc7ibbws6jlou66oxqgoaiy3aa5tvqtd5zmtapya._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/211011-p3284ahbg9/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla Payload

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3b84acfb0076055b0be8086d2f256ea7bcebc0ce0231b003b3ac263ee59303f0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4 Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research