MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d800cd8558a5d805abc7413f62e46fe9e512132e507bb57a01aaaee0a3585316. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	d800cd8558a5d805abc7413f62e46fe9e512132e507bb57a01aaaee0a3585316
SHA3-384 hash:	58b7e885922d7bddc1846f681d53c73ae29acd4676febab5126601e240cc295669bb7128603b7d06d9cd6d6e880d9a8a
SHA1 hash:	61518575a4bd74332b7843310b3cbd627e50e8f2
MD5 hash:	03524458e09eb7c92f508586e4870915
humanhash:	pizza-batman-cup-hawaii
File name:	DHL PO1001910 Sample Arrive.7z
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	496'953 bytes
First seen:	2023-03-20 07:41:22 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
ssdeep	6144:CIHH308lFy87n4B4Yn3oWuMSWW/cFbi0B24h8euHGl5DYtXMOv0FCQYor///BnlD:b3tayuLWbDVebM6O2CefIF83gm1sid
TLSH	T18BB42327BEC472896F381899015DD6791CF3AC8B9170E3C9997D1B06BBC5A1AEC4231E
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Reporter	cocaman
Tags:	7z AgentTesla DHL Shipping

cocaman

Malicious email (T1566.001)
From: ""sheng wang" (PVG HUB) (DHL CN) <sheng.wang@dhl.com>" (likely spoofed)
Received: "from dhl.com (unknown [103.125.190.179]) "
Date: "19 Mar 2023 22:46:33 -0700"
Subject: "DHL PO1001910 Sample Arrive : Tracking No_SINI0068206497 Shipping_Document"
Attachment: "DHL PO1001910 Sample Arrive.7z"

Intelligence

File Origin

# of uploads :

# of downloads :

104

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	DHL PO1001910 Sample Arrive.exe
File size:	788'480 bytes
SHA256 hash:	bc188661882a67dab838348073ba76aacf22323be1575b97931553247ff13438
MD5 hash:	daded26f31f96a37ebd4433d504821c5
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/d800cd8558a5d805abc7413f62e46fe9e512132e507bb57a01aaaee0a3585316/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/64180e4b3b01ade53e6f99d5/reports/ff0f77ba-dcc8-4768-8d5c-23eef28e256d/overview

Verdict:

Malicious

Labled as:

Mal/Drod7zip

Link:

https://www.hybrid-analysis.com/sample/d800cd8558a5d805abc7413f62e46fe9e512132e507bb57a01aaaee0a3585316

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d800cd8558a5d805abc7413f62e46fe9e512132e507bb57a01aaaee0a3585316/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2023-03-20 03:48:34 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3aam3bkyuxmalk6hie7wfzdp5hsreezokb53k6qbvkxobi2ykmla._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/230320-kap1vace39/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Checks computer location settings

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.