MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c70cd45b8f08830be5100221b664ae8e5a70b0ac397a68d9a9829f56dc0598d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8c70cd45b8f08830be5100221b664ae8e5a70b0ac397a68d9a9829f56dc0598d
SHA3-384 hash: d9dda41bca3a56c466df79b814266f184dc9c0c5ed173a46b33c81658ff65d5bb88d5471165097450cffb97b9d4880db
SHA1 hash: 5413eff0b7eca5513f85a6f5715a5160746da4d4
MD5 hash: 04af09e3ce4ddeb4b13e52febf3870cb
humanhash: mars-batman-eighteen-oregon
File name:SPW AW25 - PO.010.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:637'109 bytes
First seen:2024-09-19 12:24:24 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 12288:imNLBkTazt+i0tNmQaV+7lj62MFsl2AQEX3vrcD7qjdhx+:ppBkuzt+i0S1E96QkTYv4Dkhx+
TLSH T140D42310A355CF64E71BCF32146F1CE7CEA493A7444606AF26872CE729176222DB3ED6
TrID 57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1)
42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika sevenzip
Reporter cocaman
Tags:7z


Avatar
cocaman
Malicious email (T1566.001)
From: "Ida <ida@sungbojaya.co.id>" (likely spoofed)
Received: "from sungbojaya.co.id (216-131-73-250.iad.as62651.net [216.131.73.250]) "
Date: "19 Sep 2024 03:01:26 -0700"
Subject: "RE: SPW AW25 - PO.010 SMS"
Attachment: "SPW AW25 - PO.010.7z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:SPW AW25 - PO.010.exe
File size:856'576 bytes
SHA256 hash: 4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91
MD5 hash: 64d78850bcb1730279f0221558cfbf73
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.RATX-gen.30391.32624.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66ec182177496a3b0d6ef185
Tags:
Banker Encryption Execution Generic Network Static Kryptik Dexter
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/8c70cd45b8f08830be5100221b664ae8e5a70b0ac397a68d9a9829f56dc0598d/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/66ec181f3c9389b729b9c9f0/reports/3eeed01b-277d-43ee-bc37-3177c91491e8/overview
Verdict:
Suspicious
Labled as:
Mal/Drod7zip
Link:
https://www.hybrid-analysis.com/sample/8c70cd45b8f08830be5100221b664ae8e5a70b0ac397a68d9a9829f56dc0598d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/8c70cd45b8f08830be5100221b664ae8e5a70b0ac397a68d9a9829f56dc0598d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8c70cd45b8f08830be5100221b664ae8e5a70b0ac397a68d9a9829f56dc0598d/
Threat name:
Win32.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2024-09-19 07:36:16 UTC
File Type:
Binary (Archive)
Extracted files:
42
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rrym2rny6cedbpsraarbwzsk5ds2ocykyol2ndm2tau7k3oalggq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla credential_access discovery execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/240919-q2zx1s1eqg/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Credentials from Password Stores: Credentials from Web Browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 8c70cd45b8f08830be5100221b664ae8e5a70b0ac397a68d9a9829f56dc0598d

(this sample)

AgentTesla

Executable exe 4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91
  
Dropping
MD5 64d78850bcb1730279f0221558cfbf73

Comments