MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3636b8f5e8da9b9275cd6cc01b91058fbb21c6a4b627970cef5fa7ca6560d80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3636b8f5e8da9b9275cd6cc01b91058fbb21c6a4b627970cef5fa7ca6560d80
SHA3-384 hash: d333d8d8b9a34a05fa12d4ac635c22a8d3e34ebda9474fdc9e086e403b91cb97e1bcf71fd85e360dc2fd54799d2971ba
SHA1 hash: 1b06f51e8d89cc18961ec43622e9e1ce3c2608e5
MD5 hash: 5aef711274de06f683f537e9c7838db1
humanhash: uniform-monkey-carbon-saturn
File name:Great Lake - Quote#474701.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:644'154 bytes
First seen:2024-07-15 07:54:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:aAN2iFenzXLen85FwI3APp4q8jeBTrcE5VYm8hjnk0BDfBIIeaGqne5Yn6DuMr:aO1FIvF3QqaZrcEHzyjk0BDVdGd5LDuQ
TLSH T1F4D4233E717A9C3898C047B9446F8E71A1DECF6B60AF752448E2C40AFD219687FF1855
Reporter cocaman
Tags:AgentTesla QUOTATION zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Salar Izzaddin <info@greatlaketrading.com>" (likely spoofed)
Received: "from greatlaketrading.com (unknown [51.89.227.23]) "
Date: "12 Jul 2024 11:56:54 -0700"
Subject: "Request for Quotation - #474701 Great Lake"
Attachment: "Great Lake - Quote#474701.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
362
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Great Lake - Quote#474701.exe
File size:694'784 bytes
SHA256 hash: 0178b79bd084c2597b2de4e62e61a88bb8359e4fcac2fe672bb887e0e52e5dbd
MD5 hash: c229261d7e8c8524dd25f7bc58edddf8
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Sanesecurity.Rogue.0hr.20240712-1436.UNOFFICIAL
Create hunting rule

TwinWave.EvilZip.OnAndOn.20221219.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6694d5d9cadc6250d055603bwin7simulatehigh_evasion
Tags:
Banker Encryption Execution Generic Network Static Heur Dexter
Result
Verdict:
Suspicious
File Type:
PE File
Link:
https://app.docguard.net/a3636b8f5e8da9b9275cd6cc01b91058fbb21c6a4b627970cef5fa7ca6560d80/results/dashboard
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6694d5ebed3116b7b3d3faec/reports/98ca58f9-7ce8-444c-8b8f-3d16ddecddf9/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/a3636b8f5e8da9b9275cd6cc01b91058fbb21c6a4b627970cef5fa7ca6560d80
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/a3636b8f5e8da9b9275cd6cc01b91058fbb21c6a4b627970cef5fa7ca6560d80
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/a3636b8f5e8da9b9275cd6cc01b91058fbb21c6a4b627970cef5fa7ca6560d80
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a3636b8f5e8da9b9275cd6cc01b91058fbb21c6a4b627970cef5fa7ca6560d80/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2024-07-12 16:44:58 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
24 of 38 (63.16%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=unrwxd26rwu3sj2423gadoiqld53ehdkjnrhs4go6x5hzjswbwaa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/240715-klfljs1ajd/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a3636b8f5e8da9b9275cd6cc01b91058fbb21c6a4b627970cef5fa7ca6560d80

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a3636b8f5e8da9b9275cd6cc01b91058fbb21c6a4b627970cef5fa7ca6560d80

(this sample)

AgentTesla

Executable exe 0178b79bd084c2597b2de4e62e61a88bb8359e4fcac2fe672bb887e0e52e5dbd

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0178b79bd084c2597b2de4e62e61a88bb8359e4fcac2fe672bb887e0e52e5dbd
  
Dropping
AgentTesla
  
Dropping
MD5 c229261d7e8c8524dd25f7bc58edddf8

Comments