MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5699342ff4c62878c0876983eb60ce7d52d33f4e71fd04158d84d4571df44cfc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 16 File information Comments

SHA256 hash:	5699342ff4c62878c0876983eb60ce7d52d33f4e71fd04158d84d4571df44cfc
SHA3-384 hash:	9183e418b3b7318fde24aee1a85ae96399ed66d66854e01d4ba6b2e992d8dee85d1d328ca4bb78cb21322dc4b5ed9aec
SHA1 hash:	ebcf1fdd8ca74de507f36675eeabbe1224ad612a
MD5 hash:	bfcbf8b96af951c38e0356667f000809
humanhash:	queen-muppet-july-stairway
File name:	RFQ-HIGH STAR PROJECT - Copy.pdf.arj
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	698'020 bytes
First seen:	2024-01-24 08:35:08 UTC
Last seen:	2024-01-24 08:41:35 UTC
File type:	arj
MIME type:	application/x-rar
ssdeep	12288:SgTJKARN27Gakegc0M+w+RPKsR6U02js+Czmso8ZivmdTklkzJY0LRG1:SgtKkNDegc0xw+RyjU02IrtDPdbJ1Ls1
TLSH	T16DE433E0B95E466E2B6F9F827B5680AC39ED7C1F54433284C946E26F4FB099DE1B4402
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla arj RFQ

cocaman

Malicious email (T1566.001)
From: "Highstar Contracting LLC <engineers@highstar.ae>" (likely spoofed)
Received: "from [194.33.191.107] (unknown [194.33.191.107]) "
Date: "24 Jan 2024 09:03:06 -0800"
Subject: "Urgent project Oreder-Inquiry "
Attachment: "RFQ-HIGH STAR PROJECT - Copy.pdf.arj"

Intelligence

File Origin

# of uploads :

# of downloads :

115

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	RFQ-HIGH STAR PROJECT - Copy.pdf.exe
File size:	714'752 bytes
SHA256 hash:	b3c637ac9585fee8c462a31902497f9bd146dcf803a76f963f000c1d9a9974c9
MD5 hash:	c3932b08906d27ab9c4b4098a76aacb4
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.28929.RarHeur.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/65b0cbf9fc0458d7ffd87511/reports/7d099c2d-cba4-41d7-a20d-06334d32de40/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/5699342ff4c62878c0876983eb60ce7d52d33f4e71fd04158d84d4571df44cfc

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5699342ff4c62878c0876983eb60ce7d52d33f4e71fd04158d84d4571df44cfc/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2024-01-24 06:13:18 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=k2mtil7uyyuhrqehngb6wygopvjngp2ooh6qifmnqtkfohpujt6a._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5699342ff4c62878c0876983eb60ce7d52d33f4e71fd04158d84d4571df44cfc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4 Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research