MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5bbbee07077b7c2b73f75dfc78006e5c9e295ab11d67dc5dbe6d82c03d57dfbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	5bbbee07077b7c2b73f75dfc78006e5c9e295ab11d67dc5dbe6d82c03d57dfbd
SHA3-384 hash:	4d6f854e38ec3bab4a42d194d3e66387025e38240001f889299bea91ce3fce63ed77cc45217d39a9372dedc301868d15
SHA1 hash:	6cc1db291683b54c0c037569ecdb6be9b3da2631
MD5 hash:	eb1864fa704f54e7f92dd0f65584863b
humanhash:	carpet-kansas-oregon-network
File name:	TT copy.r15
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	409'830 bytes
First seen:	2023-04-24 06:26:23 UTC
Last seen:	2023-04-24 07:00:31 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:7n6Ux2muIk729n5C1Lv7Y5YEJV1lIiVv39:b6ixW294ZT2JVJ1
TLSH	T166942336AE6BD47A42DE6E8494F5CADA2B2327CC8B5851DCE0D1ED9084DA6D1340B3C7
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla payment r15 rar

cocaman

Malicious email (T1566.001)
From: "huasheng@gths.cn" (likely spoofed)
Received: "from gths.cn (unknown [208.67.107.136]) "
Date: "24 Apr 2023 03:41:25 +0200"
Subject: "RE: PAYMENT"
Attachment: "TT copy.r15"

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	TT copy.exe
File size:	508'416 bytes
SHA256 hash:	fc5ea1c67d2177ba18b4465551fd8e07c8b3c223443d17a364f2b7b3078aa189
MD5 hash:	3c88ec32f8490263f19e861fca809d1a
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/5bbbee07077b7c2b73f75dfc78006e5c9e295ab11d67dc5dbe6d82c03d57dfbd/results/dashboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

cmd.exe packed

Link:

https://www.filescan.io/uploads/6446213711b4ea178796e0f1/reports/37c6e88a-8b3a-4754-b71b-4034604c2650/overview

Verdict:

Malicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/5bbbee07077b7c2b73f75dfc78006e5c9e295ab11d67dc5dbe6d82c03d57dfbd

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5bbbee07077b7c2b73f75dfc78006e5c9e295ab11d67dc5dbe6d82c03d57dfbd/

Threat name:

Win32.Spyware.Negasteal

Status:

Malicious

First seen:

2023-04-23 17:05:40 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lo564byhpn6cw47xlx6hqadolspcswvrdvt5yxn6nwbmapkx366q._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230424-hr3bdsca4v/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AgentTesla

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/5bbbee07077b7c2b73f75dfc78006e5c9e295ab11d67dc5dbe6d82c03d57dfbd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.