MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8fdea17a49e969162c4d66d460eefc7df955be9a6dc3adec2ac714792f4e9e3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	8fdea17a49e969162c4d66d460eefc7df955be9a6dc3adec2ac714792f4e9e3c
SHA3-384 hash:	1cede939e26a63202fdda1b182d48566f94413acb4d1b22e456b620a294587c845d40bca9c97b1384353143a1b2b0fd0
SHA1 hash:	cb6be416a3104b68362039ddaf54c12832671098
MD5 hash:	ddebd057335b9acfbb855798424625e9
humanhash:	golf-tennis-island-fifteen
File name:	order.7Z
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	539'500 bytes
First seen:	2023-04-21 05:41:17 UTC
Last seen:	2023-04-21 05:45:49 UTC
File type:	7z
MIME type:	application/x-rar
ssdeep	12288:wAR0Q2t+mV52FaN8ut7uearGYiAqCBEvxqDClk5dpVGJGaM:NRYVKu5uear1qCBC0LVGkR
TLSH	T116B423BF42D69A96A285E2B34F4F9F036DE2075918192BECF3D11EC3E29551EE40438D
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	7z AgentTesla

cocaman

Malicious email (T1566.001)
From: "autocare@1stopautocare.com" (likely spoofed)
Received: "from 1stopautocare.com (unknown [208.67.107.136]) "
Date: "21 Apr 2023 03:32:40 +0200"
Subject: "RE: New Order"
Attachment: "order.7Z"

Intelligence

File Origin

# of uploads :

# of downloads :

141

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	order.exe
File size:	758'272 bytes
SHA256 hash:	186fb618cd82863206b3da72960bb3c4dfa9ec3beafb10cc49fabd34f7cda05f
MD5 hash:	651e56db5de3a86d1785c9d2841177c1
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/8fdea17a49e969162c4d66d460eefc7df955be9a6dc3adec2ac714792f4e9e3c/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

comodo jigsaw packed

Link:

https://www.filescan.io/uploads/6442222c51816ede1d20f9d0/reports/805634c9-50c7-4044-b90c-8c8dded6220f/overview

Verdict:

Malicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/8fdea17a49e969162c4d66d460eefc7df955be9a6dc3adec2ac714792f4e9e3c

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8fdea17a49e969162c4d66d460eefc7df955be9a6dc3adec2ac714792f4e9e3c/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=r7pkc6sj5furmlcnm3kgb3x4px4vlpu2nxb233bky4khsl2oty6a._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230421-ggayqagc41/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8fdea17a49e969162c4d66d460eefc7df955be9a6dc3adec2ac714792f4e9e3c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.