MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 466e8cdff477c01fee77c3e5ea5f719f5053785e7807b99aa09b464256adad8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 4 File information Comments

SHA256 hash:	466e8cdff477c01fee77c3e5ea5f719f5053785e7807b99aa09b464256adad8d
SHA3-384 hash:	0804018fa68ccd6f6de789c12972fb1f4bf47812ca8d194c4df8f655345292f6c24c234870581e29556066837dd0bae6
SHA1 hash:	f0f059755bf03788cd072175c6eee1d861ae193e
MD5 hash:	92fd19e4845a39b2c74c43878a86a994
humanhash:	coffee-two-lima-two
File name:	57m� LPG SEMI TRAILER 7 NOS.pdf.z
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	559'809 bytes
First seen:	2023-08-02 08:11:33 UTC
Last seen:	Never
File type:	z
MIME type:	application/x-rar
ssdeep	12288:DNPmLfDWyjx7WVlvgYdi/pDGvKSdVMDNQJpLTfsMK4CjaJ:D1qWyjx7WVJgYdOqbMDNQ3LDB
TLSH	T1D1C423D9243373D696F1FDA4000EAEC4821F1164E4F7C135AE34975E9AA79FB283A319
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla z

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe
File size:	687'616 bytes
SHA256 hash:	01af6a15beb6d627c8e7d255eb0d8f2e1167d710b101973b8da9b50246368bf3
MD5 hash:	bd6687dd7ec1ee893b0394316ec2249b
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.28929.RarHeur.UNOFFICIAL

Gathering data

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/466e8cdff477c01fee77c3e5ea5f719f5053785e7807b99aa09b464256adad8d

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/466e8cdff477c01fee77c3e5ea5f719f5053785e7807b99aa09b464256adad8d/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-08-02 01:23:33 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

23 of 38 (60.53%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=izxizx7uo7ab73txyps6ux3rt5ifg6c6pad3tgvatndeevvnvwgq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AgentTesla

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/466e8cdff477c01fee77c3e5ea5f719f5053785e7807b99aa09b464256adad8d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4 Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research