MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46f47e52ca78c2e556806be44c96eaf947d1c03df6c7fe2f11d59b1b3254529c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46f47e52ca78c2e556806be44c96eaf947d1c03df6c7fe2f11d59b1b3254529c
SHA3-384 hash: eb1ce5e92f80ce0a4df296838fe4ccfe8aab7dc5c9b2b5fe20bf7b7a2d421084a56596a7d26e079cb9a9fd7d0eb0a0f8
SHA1 hash: e36df0c2528e2502ba6306d84f23fc5962797640
MD5 hash: 8d79f99d4ce28c301006b7afe4924f1d
humanhash: asparagus-mockingbird-minnesota-vermont
File name:LEVER STYLE SEP BUY ORDER & C248SH12.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:614'457 bytes
First seen:2024-09-12 13:49:53 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 12288:x+OOXoCZodGBrBOeGlXSvlkKBT8s0YzjFgOZExJzrJjk47jN:EOOYC+ABrBWiz11zjPEx1rS8N
TLSH T1C1D42386C1C871CD60E6BE3B03E4E096F570DC0EE849FEA52ECD42566B4FD12959AC2D
TrID 57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1)
42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika sevenzip
Reporter cocaman
Tags:7z AgentTesla TNT


Avatar
cocaman
Malicious email (T1566.001)
From: "Sunny Xu <sunny.xu@leverstyle.com>" (likely spoofed)
Received: "from leverstyle.com (216-131-73-250.iad.as62651.net [216.131.73.250]) "
Date: "12 Sep 2024 06:48:36 -0700"
Subject: "SEP BUY 810PF007872-TNT CIF Vietnam Da Nang &C248SH12"
Attachment: "LEVER STYLE SEP BUY ORDER & C248SH12.7z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
222
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:LEVER STYLE SEP BUY ORDER & C248SH12.exe
File size:825'856 bytes
SHA256 hash: 8ef13cc6f1b7142f119d90c5bf9a8e8a4ef30e0151191a9f0e0b96610d8fe183
MD5 hash: 9a32e03e7274d1b2eaf10e14daaafb91
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3057.24521.12612.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66e2f18d76bc4542b04983e9
Tags:
Banker Encryption Execution Generic Network Static Heur Dexter
Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/46f47e52ca78c2e556806be44c96eaf947d1c03df6c7fe2f11d59b1b3254529c/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade overlay packed
Link:
https://www.filescan.io/uploads/66e2f1903b1017a83adb327e/reports/adba983f-43b4-4bf7-9dbe-7616cfc952db/overview
Verdict:
Suspicious
Labled as:
Mal/Drod7zip
Link:
https://www.hybrid-analysis.com/sample/46f47e52ca78c2e556806be44c96eaf947d1c03df6c7fe2f11d59b1b3254529c
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/46f47e52ca78c2e556806be44c96eaf947d1c03df6c7fe2f11d59b1b3254529c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46f47e52ca78c2e556806be44c96eaf947d1c03df6c7fe2f11d59b1b3254529c/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i32h4uwkpdbokvuanpsezfxk7fd5dqb563d74lyr2wnrwmsukkoa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla credential_access discovery execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/240912-wwf6lsxdla/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Credentials from Password Stores: Credentials from Web Browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/46f47e52ca78c2e556806be44c96eaf947d1c03df6c7fe2f11d59b1b3254529c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 46f47e52ca78c2e556806be44c96eaf947d1c03df6c7fe2f11d59b1b3254529c

(this sample)

AgentTesla

Executable exe 8ef13cc6f1b7142f119d90c5bf9a8e8a4ef30e0151191a9f0e0b96610d8fe183

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8ef13cc6f1b7142f119d90c5bf9a8e8a4ef30e0151191a9f0e0b96610d8fe183
  
Dropping
AgentTesla
  
Dropping
MD5 9a32e03e7274d1b2eaf10e14daaafb91

Comments