MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95fe9b80f0a241ea6c42d44234fd50951873d683c96bdab50c41d3e4f3452b6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 95fe9b80f0a241ea6c42d44234fd50951873d683c96bdab50c41d3e4f3452b6c
SHA3-384 hash: dacaecdec030700f23ec8db65601a379169304ec0bf9591bbc9ecc5bdca28f05612c89b2dea4fb3a0d5a2dc3e455c77d
SHA1 hash: b4215b4db06737403c8f0071cbf80bc5b79bf6f6
MD5 hash: 5f9eef815d1c7e0eddab42e0b8947399
humanhash: michigan-purple-whiskey-minnesota
File name:Ningbo - Past Due Invoices.7z.001
Download: download sample
Signature AgentTesla
Create hunting rule
File size:608'674 bytes
First seen:2024-09-24 11:55:29 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 12288:VDyX0Y1O52DCRelYAeZjqjkazCtH2SQWkE5IxtMb7RYLgXEevG3UPt1tJU9k:BOy2DC0YwqH2SZWjMb7GEXRe3Id
TLSH T1BAD4231ED2C3C765E592C92B7CB8D375CA8B5F8B1134F7CAAB77A36F50A10494050C5A
TrID 57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1)
42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika sevenzip
Reporter cocaman
Tags:001 7z AgentTesla DHL INVOICE


Avatar
cocaman
Malicious email (T1566.001)
From: ""Dong Sen Xue (DHL CN)" <dongsen.xue@dhl.com>" (likely spoofed)
Received: "from dhl.com (unknown [45.137.22.229]) "
Date: "24 Sep 2024 13:55:04 +0200"
Subject: "RE: TOP URGENT! Ningbo - Invoices - Past Due"
Attachment: "Ningbo - Past Due Invoices.7z.001"

Intelligence

File Origin
# of uploads :
1
# of downloads :
136
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Ningbo - Past Due Invoices.scr
File size:673'280 bytes
SHA256 hash: d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3
MD5 hash: 05971e8521240cd588015e689baab4b7
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3061.17047.210.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66f2a8da5346c7b922ada156
Tags:
Execution Network Stealth Msil Agenttesla Micro Tori Msil
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/66f2a8d98687fc2f92d3954e/reports/30bf531a-61bd-4a79-898b-657d6e68a425/overview
Verdict:
Suspicious
Labled as:
Mal/Drod7zip
Link:
https://www.hybrid-analysis.com/sample/95fe9b80f0a241ea6c42d44234fd50951873d683c96bdab50c41d3e4f3452b6c
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/95fe9b80f0a241ea6c42d44234fd50951873d683c96bdab50c41d3e4f3452b6c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/95fe9b80f0a241ea6c42d44234fd50951873d683c96bdab50c41d3e4f3452b6c/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2024-09-24 03:12:21 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
18 of 24 (75.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sx7jxahquja6u3cc2rbdj7kqsumhhvudzfv5vnimihj6j42ffnwa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/240924-sb6nzstbqf/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Command and Scripting Interpreter: PowerShell
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/95fe9b80f0a241ea6c42d44234fd50951873d683c96bdab50c41d3e4f3452b6c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RSharedStrings
Create hunting rule
Author:Katie Kleemola
Description:identifiers for remote and gmremote
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 95fe9b80f0a241ea6c42d44234fd50951873d683c96bdab50c41d3e4f3452b6c

(this sample)

AgentTesla

Executable exe d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3
  
Dropping
AgentTesla
  
Dropping
MD5 05971e8521240cd588015e689baab4b7

Comments