MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46fa9da80e40bcd770af060a7264de128159d7dd6aa0cdb1247222b9a489b89d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	46fa9da80e40bcd770af060a7264de128159d7dd6aa0cdb1247222b9a489b89d
SHA3-384 hash:	ab3e5ef12b6686e1c6bef7c5284f9b8c9e2b814e29cae30ff42547c86fa6bea06d5ed84765d1cc4f5214618250bad6f6
SHA1 hash:	30426de1f7ca7bb5c9f62fde4b3e6860992c4ed7
MD5 hash:	615b96a40531244daf6b07243406ca0e
humanhash:	paris-arkansas-indigo-sierra
File name:	IMG18.12.24.pdf.rar
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	605'734 bytes
First seen:	2024-12-18 05:41:45 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:p5kBXUf8Krrvle85Sgbtys+M051RksGUwW1RBx8MTmFX7uAS6K7L8dJfU:p5kpOr0gSzs3WLf/x8Wmhz3C47fU
TLSH	T1E1D423A7E1F0DD80C4399539B8A5BCFF6B7223D481E0FCA607A5026C53516D66CBAC63
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	mamrmtsh
Tags:	AgentTesla rar

Intelligence

File Origin

# of uploads :

# of downloads :

146

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=676261718fb73f13afd14f65

Tags:

autoit emotet

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context autoit compiled-script control fingerprint keylogger lolbin microsoft_visual_cc mpcmdrun packed regsvr32

Link:

https://www.filescan.io/uploads/676260aa21bbe1761ca60ee1/reports/d6ba7046-6ed1-41df-9fee-8db2c6677e71/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/46fa9da80e40bcd770af060a7264de128159d7dd6aa0cdb1247222b9a489b89d

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/46fa9da80e40bcd770af060a7264de128159d7dd6aa0cdb1247222b9a489b89d/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2024-12-18 05:42:04 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

12 of 38 (31.58%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=i35j3kaoic6no4fpayfhezg6ckavtv65nkqm3mjeoirltjejxcoq._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/241218-gxledswpgt/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

AgentTesla

Agenttesla family

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)