MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d30c8af8cb95ae21a6a2d2a20f5ab9610bc6ae92a580b03b739424a849af069e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	d30c8af8cb95ae21a6a2d2a20f5ab9610bc6ae92a580b03b739424a849af069e
SHA3-384 hash:	df1f503cc7a452ff637c12cd87ed2b69c69620a183808fab2eac65761a0ba2cc8e0c94f5ca14c02a1b5ef44c52101d92
SHA1 hash:	b40ccfd19b49cac3451f264b890a9979a6e67178
MD5 hash:	b9c6b9d653f6e3eff03a5aa66e3a04aa
humanhash:	london-wolfram-hotel-beryllium
File name:	RFQ #ORDER.gz
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	527'419 bytes
First seen:	2022-12-12 13:07:04 UTC
Last seen:	Never
File type:	gz
MIME type:	application/x-rar
ssdeep	12288:L2oKKpw3+BteLLIJuXSURF/GEh+NfJHt8YQ3W637:Ln9C3wuJwBHSM637
TLSH	T1A8B423EBF62928A2D59EDE191223EC051FCD6C8619667790570CE6C6D3B71C30F482EB
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla gz RFQ

cocaman

Malicious email (T1566.001)
From: "Marketing R&E <accounts@ariatungga.com>" (likely spoofed)
Received: "from mail.ariatungga.com (unknown [131.153.22.141]) "
Date: "04 Dec 2022 23:29:22 -0800"
Subject: "RE: RFQ# RE-M472-SUPPLY Polypropylene Rope"
Attachment: "RFQ #ORDER.gz"

Intelligence

File Origin

# of uploads :

# of downloads :

121

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	RFQ #ORDER.exe
File size:	685'056 bytes
SHA256 hash:	900f7aff738126f83c3181410a3909ebbf1de94a75fe4ec1a74532252124e36c
MD5 hash:	44f5dafe0cbcf3606c5a2976047156b7
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/639727b30c6473d1671a9fd2/reports/e4216f5c-4191-48ef-8d36-e0d8136a4ebb/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d30c8af8cb95ae21a6a2d2a20f5ab9610bc6ae92a580b03b739424a849af069e/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-12-05 18:16:41 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

25 of 40 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2mgiv6glswxcdjvc2kra6wvzmef4nlusuwalao3tsqskqsnpa2pa._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/221212-rse2xsec3y/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d30c8af8cb95ae21a6a2d2a20f5ab9610bc6ae92a580b03b739424a849af069e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.