MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72706aca5ee66be0402686362affbc12ed70ad603179ac14dabb3c53fd0a9a5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72706aca5ee66be0402686362affbc12ed70ad603179ac14dabb3c53fd0a9a5d
SHA3-384 hash: 4411f003c7af7f42a97d29572dd50e6e32ae98d7445521c1e4b4ae081a85375df4f21c4f59781d29906bd2beb3d1feb9
SHA1 hash: 721535d0706e5c24941c8d0709ce94e6b9bbd936
MD5 hash: 79183c902b7787f55b29e032423c5e6a
humanhash: monkey-pasta-nuts-emma
File name:SWF316012401180017.PDF.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:643'591 bytes
First seen:2024-01-24 08:36:58 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:FeGULehioJ+GUuMhWqV9eMttrg7CYnMko/kYKBL5wNw1O8Fuveh6Ge8pPa:FtfhRJPIZjtrCC2NoVKB+NwQ8FVnPa
TLSH T197D43315893B98E4632B9598E5CBE385260D774023C6ECB3D115F85BE3DE7628C1A8B3
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:AgentTesla gz SWIFT


Avatar
cocaman
Malicious email (T1566.001)
From: "no-reply@oman-arabbank.com <no-reply@oman-arabbank.com>" (likely spoofed)
Received: "from oman-arabbank.com (unknown [185.222.58.40]) "
Date: "24 Jan 2024 06:23:37 +0100"
Subject: "FW: Swift Message Advice"
Attachment: "SWF316012401180017.PDF.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:SWF316012401180017.PDF.exe
File size:712'192 bytes
SHA256 hash: f7431cb039b7b6deb859f5afd5c813fca0f9a1b47dbcb0cd7bba5ce3a9b754d9
MD5 hash: e33d9df8e43a4b1833f8993f4c0fdce7
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/65b0cc35eda27a7ac100b10c/reports/6917fec7-c53b-4427-a0ab-3dae54a07c2a/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/72706aca5ee66be0402686362affbc12ed70ad603179ac14dabb3c53fd0a9a5d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/72706aca5ee66be0402686362affbc12ed70ad603179ac14dabb3c53fd0a9a5d/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ojygvss64zv6aqbgqy3cv754clwxbllagf42yfg2xm6fh7iktjoq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/240124-lh65rsfaep/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/72706aca5ee66be0402686362affbc12ed70ad603179ac14dabb3c53fd0a9a5d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 72706aca5ee66be0402686362affbc12ed70ad603179ac14dabb3c53fd0a9a5d

(this sample)

AgentTesla

Executable exe f7431cb039b7b6deb859f5afd5c813fca0f9a1b47dbcb0cd7bba5ce3a9b754d9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f7431cb039b7b6deb859f5afd5c813fca0f9a1b47dbcb0cd7bba5ce3a9b754d9
  
Dropping
MD5 e33d9df8e43a4b1833f8993f4c0fdce7

Comments