MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa5eee10bc3ef5df140db90115eb0e7830f9946df1281bc7e5a2e9dddc0e5262. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 10 File information Comments

SHA256 hash:	aa5eee10bc3ef5df140db90115eb0e7830f9946df1281bc7e5a2e9dddc0e5262
SHA3-384 hash:	d34116565144adbe36f057712d438834e8321ebeef8973a0b276f270f0e555d458bc7f163be9690216bdfde298f667a6
SHA1 hash:	01c770e620262d3ccc5dbeb208dc7c4814ce488e
MD5 hash:	209d05e1bea4668144e8e0d1b4639d31
humanhash:	ohio-cold-double-monkey
File name:	QUOTE PR009583.pdf.z
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	257'055 bytes
First seen:	2023-07-25 07:35:52 UTC
Last seen:	Never
File type:	z
MIME type:	application/x-rar
ssdeep	6144:27sUxTD262+I9DiVLY2r6HG05CUZtIZHaYEVCfX5LgL4LFLBM:HwD262+I9Di5Tr2L5CUTIZqCv6L4LFa
TLSH	T1384423F0E4923E0CE32E27A91AEF7D464CF10F6D73B366D1487E059AA8A6476903C5C1
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla QUOTATION RFQ z

cocaman

Malicious email (T1566.001)
From: "Ali Ekici <sales@coroplast-tape.com>" (likely spoofed)
Received: "from coroplast-tape.com (unknown [45.137.22.91]) "
Date: "25 Jul 2023 07:00:25 +0200"
Subject: "REQUEST FOR QUOTATION PR009583-RFQ"
Attachment: "QUOTE PR009583.pdf.z"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	QUOTE PR009583.pdf.exe
File size:	272'974 bytes
SHA256 hash:	74e32d627908ba34556010cb469812beab29672d102d1ef23b6e67de10ed9041
MD5 hash:	a568eabf6caf8d9e60a3d89836a1ab8a
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.28929.RarHeur.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

control lolbin masquerade overlay packed shell32

Link:

https://www.filescan.io/uploads/64bf7b638be3f49cc38dd630/reports/80b51488-9be0-48ef-9fb0-3c2c6b7405db/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/aa5eee10bc3ef5df140db90115eb0e7830f9946df1281bc7e5a2e9dddc0e5262

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aa5eee10bc3ef5df140db90115eb0e7830f9946df1281bc7e5a2e9dddc0e5262/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-07-25 04:54:40 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vjpo4ef4h3256fanxearl2yopayptfdn6eubxr7fulu53xaokjra._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/aa5eee10bc3ef5df140db90115eb0e7830f9946df1281bc7e5a2e9dddc0e5262

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV4 Create hunting rule
Author:	Rony (r0ny_123)

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	MSIL_SUSP_OBFUSC_XorStringsNet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:	https://github.com/dr4k0nia/yara-rules

Rule name:	msil_susp_obf_xorstringsnet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it

Rule name:	pe_imphash Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4 Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research