MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7bc827a962f298f997e04ef979b0cd3ce5448476eb48c6c8014f12a8da623e34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 4

Intelligence 4 IOCs YARA 5 File information Comments

SHA256 hash:	7bc827a962f298f997e04ef979b0cd3ce5448476eb48c6c8014f12a8da623e34
SHA3-384 hash:	0605ade95c67f6923fd6c742929d3a4e9494be70a623eb1b56bb3e6d46557c842339b4dbe57ac248e3d10964456eea1c
SHA1 hash:	49c69f94ad7137a936118e1c09c645068d98dbab
MD5 hash:	bd6aa87c7fd1b3a4310f32c448adcad4
humanhash:	social-wisconsin-zebra-fish
File name:	SWIFT MESAJ TAVSİYESİ.pdf.7z
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	643'601 bytes
First seen:	2024-01-24 08:37:30 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-rar
ssdeep	12288:ieGULehioJ+GUuMhWqV9eMttrg7CYnMko/kYKBL5wNw1O8Fuveh6Ge8pPD:itfhRJPIZjtrCC2NoVKB+NwQ8FVnPD
TLSH	T197D43315893B98E4632B9598E5CBE385260D774023C6ECB3D115F85BE3DE7628C1A8B3
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	7z AgentTesla SWIFT

cocaman

Malicious email (T1566.001)
From: "no-reply@oman-arabbank.com <no-reply@oman-arabbank.com>" (likely spoofed)
Received: "from oman-arabbank.com (unknown [185.222.58.40]) "
Date: "24 Jan 2024 06:23:37 +0100"
Subject: "FW: Swift Message Advice"
Attachment: "SWIFT MESAJ TAVSİYESİ.pdf.7z"

Intelligence

File Origin

# of uploads :

# of downloads :

134

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	SWIFT MESAJ TAVSİYESİ.pdf.exe
File size:	712'192 bytes
SHA256 hash:	f7431cb039b7b6deb859f5afd5c813fca0f9a1b47dbcb0cd7bba5ce3a9b754d9
MD5 hash:	e33d9df8e43a4b1833f8993f4c0fdce7
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.28929.RarHeur.UNOFFICIAL

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/7bc827a962f298f997e04ef979b0cd3ce5448476eb48c6c8014f12a8da623e34/results/dashboard

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7bc827a962f298f997e04ef979b0cd3ce5448476eb48c6c8014f12a8da623e34/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ppecpklc6kmptf7aj34xtmgnhtsujbdw5nemnsabj4jkrwtchy2a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/240124-lh65rsfaeq/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7bc827a962f298f997e04ef979b0cd3ce5448476eb48c6c8014f12a8da623e34

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4 Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research