MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b06f144699551865b4f52d980587004bc98acc51b73009a708a997b27acadf9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b06f144699551865b4f52d980587004bc98acc51b73009a708a997b27acadf9a
SHA3-384 hash:	8621743228d317ea35e410e32cb41abb3dd23c3544c25d0aea9d8b528c3bd0f7c78d51b06d8a536330ef347aec50b9cd
SHA1 hash:	aab65139630b385db79720e6555cfa380b1ace5a
MD5 hash:	fea03ea02afcec817bbfd3bcb3b7928d
humanhash:	eighteen-eleven-winter-kilo
File name:	Purchase Inquiry.tgz
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	825'232 bytes
First seen:	2023-09-06 04:57:32 UTC
Last seen:	Never
File type:	gz
MIME type:	application/gzip
ssdeep	3072:p4OBU1Pa1anp/cge1LQ2Amdvf0QkNA0qQeAcPdu:6neeMvfk3Uddu
TLSH	T17805026028F8BB19F7C9763AC290BDAED72EF9819B7B3D4E2A01D07DB8C70051768511
Reporter	JAMESWT_WT
Tags:	AgentTesla file-pumped gz

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

93

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Purchase Inquiry.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	700'000'000 bytes
SHA256 hash:	1b2fa37c67d9e56a7153c170a7d0456e0109c681604a6d06621c106733230b08
MD5 hash:	97b8b5df44c35c07d1590449a33206c7
De-pumped file size:	354'304 bytes (Vs. original size of 700'000'000 bytes)
De-pumped SHA256 hash:	37a059a4d06fba240f6a6e6eaea9e3b519e6a31603af7e800f19155b04c25129
De-pumped MD5 hash:	c1220eeb6a80672e0b96646205523ba6
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

control large-file lolbin masquerade overlay replace

Link:

https://www.filescan.io/uploads/64f806db4578d9c35e03bcc1/reports/1cd0a9c5-fa62-481c-9db0-fa480db6e479/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b06f144699551865b4f52d980587004bc98acc51b73009a708a997b27acadf9a

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b06f144699551865b4f52d980587004bc98acc51b73009a708a997b27acadf9a/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wbxriruzkumglnhvfwmalbyajpeyvtcrw4yatjyivgl3e6wk36na._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230906-fwzpysdd74/

Behaviour

Gathers network information

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b06f144699551865b4f52d980587004bc98acc51b73009a708a997b27acadf9a