MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a36f044f83511535a62d1187b10d5c92bf557cd07bf85f36519330c04712bb66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a36f044f83511535a62d1187b10d5c92bf557cd07bf85f36519330c04712bb66
SHA3-384 hash: adf8aff3145df8a97f51cdceca5a80bb458d8070a7841a1ecb202c285f692537eea52fdecdec81efda504e5c8d0e266b
SHA1 hash: 6dd1e425054ab1471676cee7860288cae2248507
MD5 hash: 3f624d66d034cc0b47e1cc90f620293e
humanhash: lake-kansas-paris-robert
File name:SOA pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'310'720 bytes
First seen:2023-10-26 11:51:06 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:tsxTA6q+YIItbIqt8qedaQ5ZmAhXRwIY2NKJGCkui1iDjUqO24XhvMsK6Ed3:yxs66btEM8d42Y+6/kKjGhEsgd3
TLSH T16D55F19536BDAF0BD63AB7F60950508507F5A0792272D70E6EEA70DB0E94B118F40F2B
TrID 50.6% (.ISO/UDF) UDF disc image (2114500/1/6)
49.0% (.NULL) null bytes (2048000/1)
0.1% (.ATN) Photoshop Action (5007/6/1)
0.0% (.ISO) ISO 9660 CD image (2545/36/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
Reporter cocaman
Tags:AgentTesla img Shipping


Avatar
cocaman
Malicious email (T1566.001)
From: "duwonferry.com <edcapt@duwonferry.com>" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [185.222.57.92]) "
Date: "24 Oct 2023 16:35:13 +0200"
Subject: "Shipping Order"
Attachment: "SOA pdf.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:VF8LYKLS.EXE
File size:750'080 bytes
SHA256 hash: 8efb5396b4a7e5fea2644c844c1ab7e000b8ce9cafdc1c7172d480731f16c8fc
MD5 hash: 7ec536edfb2f45676b6ca798a49d8dd4
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Packed2.45834.9781.16452.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
context-iso packed
Link:
https://www.filescan.io/uploads/653a52e3bc703e36b08e7377/reports/8e9701b6-6c76-4cb5-98d5-6b0fd58a9830/overview
Verdict:
Malicious
Labled as:
Possibl.E94332FB
Link:
https://www.hybrid-analysis.com/sample/a36f044f83511535a62d1187b10d5c92bf557cd07bf85f36519330c04712bb66
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a36f044f83511535a62d1187b10d5c92bf557cd07bf85f36519330c04712bb66/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-10-24 03:58:33 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
15 of 36 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=unxqit4dkektljrncgd3cdk4sk7vk7gqpp4f6nsrsmymarysxnta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/a36f044f83511535a62d1187b10d5c92bf557cd07bf85f36519330c04712bb66

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img a36f044f83511535a62d1187b10d5c92bf557cd07bf85f36519330c04712bb66

(this sample)

AgentTesla

Executable exe 8efb5396b4a7e5fea2644c844c1ab7e000b8ce9cafdc1c7172d480731f16c8fc

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8efb5396b4a7e5fea2644c844c1ab7e000b8ce9cafdc1c7172d480731f16c8fc
  
Dropping
AgentTesla

Comments