MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8581baa29191751e2d2b59a0260001c7449166538bed44befc800a96490daaff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8581baa29191751e2d2b59a0260001c7449166538bed44befc800a96490daaff
SHA3-384 hash: b911bb40e23558c03d2ed2a7db6acb093add364392c6f7f96bbe5fc363d36affb53872cd78bf12e038678a1322093051
SHA1 hash: 11d182092c319d90a23559c730123db83b3ed78f
MD5 hash: 54062305bc17c98bf97f737b27b9bbdc
humanhash: lemon-carbon-london-washington
File name:Bulk_OrderSheet_KIDO VINH.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:128'877 bytes
First seen:2025-03-05 14:26:01 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 3072:hhsDaErcELKoEOy1y3RMfolaKUcdftT5gPuuM6mp8vL5d1Sh:hCmo5Xyv+JSM6PL5dO
TLSH T1C2C3125BD828760D6B88BC8BC7D4441E5110F3B354A79ECEB14E7F898B79B043A7E960
TrID 57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1)
42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika sevenzip
Reporter cocaman
Tags:7z AgentTesla


Avatar
cocaman
Malicious email (T1566.001)
From: "impvinh32@kido.co.kr <impvinh32@kido.co.kr>" (likely spoofed)
Received: "from kido.co.kr (192-200-158-132.phx.as13926.net [192.200.158.132]) "
Date: "05 Mar 2025 06:24:59 -0800"
Subject: "FW25 BULK/KIDO VINH"
Attachment: "Bulk_OrderSheet_KIDO VINH.7z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Bulk_OrderSheet_KIDO VINH.com
File size:338'544 bytes
SHA256 hash: 74a794e49ad3d2118eb14395b7fead75084e0a91ea6cfabde8fd684c0f1f8344
MD5 hash: cefe1828e1e5af2d016eb1d17c57a88e
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3259.839.28437.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67c86054c668b65489bf328e
Tags:
autorun lien
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
invalid-signature masquerade net_reactor obfuscated obfuscated overlay packed signed
Link:
https://www.filescan.io/uploads/67c85f0f3c5f644bd9443198/reports/847dfd70-ce7f-451e-b199-94c1defa86f7/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/8581baa29191751e2d2b59a0260001c7449166538bed44befc800a96490daaff
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Score:
82%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/8581baa29191751e2d2b59a0260001c7449166538bed44befc800a96490daaff
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8581baa29191751e2d2b59a0260001c7449166538bed44befc800a96490daaff/
Threat name:
Win32.Trojan.Jalapeno
Create hunting rule
Status:
Malicious
First seen:
2025-03-05 09:29:41 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
16 of 38 (42.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qwa3viursf2r4ljllgqcmaaby5cjczstrpwujpx4qafjmsinvl7q._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery keylogger spyware stealer trojan
Link:
https://tria.ge/reports/250305-rtsdms1ms7/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Drops startup file
AgentTesla
Agenttesla family
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/8581baa29191751e2d2b59a0260001c7449166538bed44befc800a96490daaff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:win32_dotnet_obfuscate
Create hunting rule
Author:Reedus0
Description:Rule for detecting .NET obfuscated malware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 8581baa29191751e2d2b59a0260001c7449166538bed44befc800a96490daaff

(this sample)

AgentTesla

Executable exe 74a794e49ad3d2118eb14395b7fead75084e0a91ea6cfabde8fd684c0f1f8344

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 74a794e49ad3d2118eb14395b7fead75084e0a91ea6cfabde8fd684c0f1f8344
  
Dropping
MD5 cefe1828e1e5af2d016eb1d17c57a88e

Comments