MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44b147c4a213fe6780ddc2783d95a084a4973d5b5bdd01cbd385549d127f6eb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 5 File information Comments

SHA256 hash:	44b147c4a213fe6780ddc2783d95a084a4973d5b5bdd01cbd385549d127f6eb7
SHA3-384 hash:	0bb462dfccc575b38da33080486edbe1aa2b061e25ec6f6f60196e73415f83e87aa7152ac221d85a4e5a90b27d989549
SHA1 hash:	1a74838cc5213ef8dcf4b2d852b04b3b715b7176
MD5 hash:	d6565911336349adf323d396ce5d0666
humanhash:	hot-johnny-bluebird-comet
File name:	COMMERCIAL INVOICE.pdf.rar
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	543'697 bytes
First seen:	2023-09-13 07:29:26 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:oRLj+rJn1paoNwpjk9ft9riXiNAtWdxUnqLRN/06P74:oRv+lnTNwVkz9riyStWPbRR06P74
TLSH	T150C4230EE9A37021F56C0AD4364E83A5F788C4179E17E319CA15B31F88F99B7EB35560
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla INVOICE rar

cocaman

Malicious email (T1566.001)
From: "Kevin Schweikert <Kevin.Schweikert@sekologistics.com>" (likely spoofed)
Received: "from sekologistics.com (unknown [194.180.48.78]) "
Date: "12 Sep 2023 18:05:36 +0200"
Subject: "confirm CI copy RE: Cargo status imega#23102 MO PO# 4100111977"
Attachment: "COMMERCIAL INVOICE.pdf.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

101

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	COMMERCIAL INVOICE.pdf.exe
File size:	584'192 bytes
SHA256 hash:	fcd2ed1088d64779e16e5134652d8360212e613b75c6cd5929216cabe27cfeeb
MD5 hash:	3c1b81c1b52580728d88bfbff50eedf8
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.28929.RarHeur.UNOFFICIAL

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/44b147c4a213fe6780ddc2783d95a084a4973d5b5bdd01cbd385549d127f6eb7/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/650164fe9bae8a378554ec30/reports/9012ad67-e801-47dd-a735-8caba414bb0c/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/44b147c4a213fe6780ddc2783d95a084a4973d5b5bdd01cbd385549d127f6eb7

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/44b147c4a213fe6780ddc2783d95a084a4973d5b5bdd01cbd385549d127f6eb7/

Threat name:

ByteCode-MSIL.Spyware.Negasteal

Status:

Malicious

First seen:

2023-09-12 08:06:48 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 37 (45.95%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=isyuprfccp7gpag5yj4d3fnaqssjopk3lpoqds6tqvkj2et7n23q._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230913-jqd3vach69/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/44b147c4a213fe6780ddc2783d95a084a4973d5b5bdd01cbd385549d127f6eb7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4 Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research