MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52c9bc1194f7d91d7212cdac617b0c5dafca840805785fe7b33cf727515705f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	52c9bc1194f7d91d7212cdac617b0c5dafca840805785fe7b33cf727515705f4
SHA3-384 hash:	eea5ffa6e44fd99d8e3db41d276dfd53aaf65787ceabce61c770786ff4d75699c919d9f179a3a976f6a3cdf2ffa390c1
SHA1 hash:	bdd82b70e344867e532f0a9ef6f63f647ed6aa37
MD5 hash:	77f772792552f65486de77b40d0cd7f0
humanhash:	monkey-florida-connecticut-oscar
File name:	PRINT COPY pdf.rar
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	518'572 bytes
First seen:	2023-04-17 12:23:50 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	6144:w2eqawTiu6fJV6pkAlqA9gFalMG54r4N7OA6zN7rOCIqrQQlRS83oaoan7Lhq1OY:kjf2TqA9gW5i4xh07rYqzC2/2V8MihvW
TLSH	T10EB42361DDC2857F5286A1F32AC28908C3474FF65B6511709DFF27DA3F692BB9321848
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla payment rar

cocaman

Malicious email (T1566.001)
From: "PURCHASE <purchase@assat-imgroup.com>" (likely spoofed)
Received: "from assat-imgroup.com (unknown [212.87.204.245]) "
Date: "Mon, 17 Apr 2023 05:22:29 -0700"
Subject: "proof of payment"
Attachment: "PRINT COPY pdf.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

136

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	9PFPVre4zn0RRu7.exe
File size:	683'520 bytes
SHA256 hash:	a036acc68623b42509e807b81be7270e1fc0c626aa15d8164d2f52bd321be1fd
MD5 hash:	aefa8cbe84f6dd9cd5b9eb5f96925935
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/52c9bc1194f7d91d7212cdac617b0c5dafca840805785fe7b33cf727515705f4/results/dashboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/643d3a6548716a65fb20235f/reports/ba24bbed-851b-4c68-9c88-875ef947bffa/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/52c9bc1194f7d91d7212cdac617b0c5dafca840805785fe7b33cf727515705f4

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/52c9bc1194f7d91d7212cdac617b0c5dafca840805785fe7b33cf727515705f4/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kle3yemu67mr24qszwwgc6ymlwx4vbaiav4f7z5tht3soukxax2a._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/230417-pl66qafg6s/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Malware Config

C2 Extraction:

https://api.telegram.org/bot6198912739:AAFWwPOzcAOeh_bttxtGKKR_RIR4wgbcmQU/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AgentTesla

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/52c9bc1194f7d91d7212cdac617b0c5dafca840805785fe7b33cf727515705f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.