MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ddd5ca69e73db1d9b370782472183aae6e088f2c89a027f1deb3ec3051e844c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments

SHA256 hash:	4ddd5ca69e73db1d9b370782472183aae6e088f2c89a027f1deb3ec3051e844c
SHA3-384 hash:	e92a372e8491e2dd48314dcabe629f09b3f6c54019fe6f276e143b6d676eaa656bc206945c2383118f1adf09e141475d
SHA1 hash:	aa1486e1945a71a95a18086940d7e6a927389469
MD5 hash:	c1e324f74ad1daeb0d166964b37ed369
humanhash:	failed-iowa-georgia-table
File name:	LPG SEMI TRAILER 7 NOS.pdf.zip
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	452'091 bytes
First seen:	2023-01-11 17:01:10 UTC
Last seen:	2023-01-11 17:22:05 UTC
File type:	zip
MIME type:	application/zip
ssdeep	6144:3RUL81PfEBoIybKNcs2Wsst2w5XbeGmEQVJLL0SHeG4/jGhHP9Mxo+j2zWznuZcp:O81PfEBoKx2pw5SkQVJx+lKhdWa6qk
TLSH	T1F2A423E9D36C5B34741946BC10DBE3578A1D6EDB2C8638DCCE4396F7D0248AA4F82A16
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	AgentTesla zip

cocaman

Malicious email (T1566.001)
From: "Shaikh Jaffar Ali <sales@energyengineering.com>" (likely spoofed)
Received: "from energyengineering.com (unknown [103.141.138.139]) "
Date: "11 Jan 2023 09:20:38 -0800"
Subject: "=?UTF-8?B?UkZRIE5ldyBPcmRlciAtIDU3bcKzIExQRyBTRU1JIFRSQUlMRVIgNyBOT1Mu?="
Attachment: "LPG SEMI TRAILER 7 NOS.pdf.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	LPG SEMI TRAILER 7 NOS.pdf.exe
File size:	519'680 bytes
SHA256 hash:	d896aeab1ada4fc3029f6b8ce8f9852775e3b0e30d7b13582208c052f8e8e20c
MD5 hash:	ea44965a15eb9c963c57b65a1a4cc956
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL

Sanesecurity.Rogue.0hr.20230111-1135.UNOFFICIAL

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/4ddd5ca69e73db1d9b370782472183aae6e088f2c89a027f1deb3ec3051e844c/results/dashboard

Verdict:

No Threat

Threat level:

2/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/63beeb8bdde391056ac2181f/reports/22f8aac0-d127-4bc3-b8fe-d43622690163/overview

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/4ddd5ca69e73db1d9b370782472183aae6e088f2c89a027f1deb3ec3051e844c

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4ddd5ca69e73db1d9b370782472183aae6e088f2c89a027f1deb3ec3051e844c/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-01-11 09:11:10 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jxovzju6opnr3gzxa6beoimdvltobchszcnae7y55m7mgbi6qrga._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/4ddd5ca69e73db1d9b370782472183aae6e088f2c89a027f1deb3ec3051e844c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1 Create hunting rule
Author:	Florian Roth
Description:	Detects characteristics of suspicious file names or double extensions often found in phishing mail attachments
Reference:	https://twitter.com/0xtoxin/status/1540524891623014400?s=12&t=IQ0OgChk8tAIdTHaPxh0Vg