MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da41a1b5363b883fb13c819c595ead87b269dba1bfb51b8176669adcdfe49d8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da41a1b5363b883fb13c819c595ead87b269dba1bfb51b8176669adcdfe49d8a
SHA3-384 hash: e1b8b26f463ced66f724f187f03ebb2a7f065f8f1523299370b2ad5555b15479885399f6e6ff70136ba9bffa19aec2bf
SHA1 hash: 881e8d807561657f972e7c0fc36f946faf6cc10e
MD5 hash: f7aff02f3542e92dd66f93b5e59dadcd
humanhash: double-rugby-delaware-lion
File name:Global e-Banking Payment Advice 000000164.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:685'277 bytes
First seen:2024-09-18 10:36:13 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 12288:Fjzkpx8txNxA0Phpiv6GFx3u3w/8DxukEf8uMe2HgkTU+OwFR7/hbd9bbt/3Sb:Fn6ufxhJcv5KgAa8u7+gkTUA/7pbd9vU
TLSH T1D4E4236D27FCD9C4169BE474E21B127BB6C3A540BB740E997920393822454ECFF76B82
TrID 57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1)
42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika sevenzip
Reporter cocaman
Tags:7z payment


Avatar
cocaman
Malicious email (T1566.001)
From: "Joy <joy@climbacle.com.tw" (likely spoofed)
Received: "from climbacle.com.tw (216-131-73-250.iad.as62651.net [216.131.73.250]) "
Date: "18 Sep 2024 03:34:46 -0700"
Subject: "Global e-Banking Payment Advice"
Attachment: "Global e-Banking Payment Advice 000000164.7z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Global e-Banking Payment Advice 000000164.exe
File size:1'087'488 bytes
SHA256 hash: 617aad709ac7d66890968766cc4b21481d268624d5505963058e7fa10748a57c
MD5 hash: bbec860047a8e57d464f8ca00ba3dd9e
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Nanocore-10025638-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66eaad50f72de0d131be992d
Tags:
Execution Network Static Stealth Gensteal
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/da41a1b5363b883fb13c819c595ead87b269dba1bfb51b8176669adcdfe49d8a/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade overlay packed
Link:
https://www.filescan.io/uploads/66eaad4e043c09361a30521e/reports/93da0482-9692-4b8d-a62e-a2ecabe62072/overview
Verdict:
Suspicious
Labled as:
Mal/Drod7zip
Link:
https://www.hybrid-analysis.com/sample/da41a1b5363b883fb13c819c595ead87b269dba1bfb51b8176669adcdfe49d8a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/da41a1b5363b883fb13c819c595ead87b269dba1bfb51b8176669adcdfe49d8a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da41a1b5363b883fb13c819c595ead87b269dba1bfb51b8176669adcdfe49d8a/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2024-09-18 08:04:41 UTC
File Type:
Binary (Archive)
Extracted files:
62
AV detection:
19 of 24 (79.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ja2dnjwhoed7mj4qgofsxvnq6zgtw5bx62rxalwm2nnzx7etwfa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla credential_access discovery execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/240918-shwglaxejc/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Credentials from Password Stores: Credentials from Web Browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z da41a1b5363b883fb13c819c595ead87b269dba1bfb51b8176669adcdfe49d8a

(this sample)

AgentTesla

Executable exe 617aad709ac7d66890968766cc4b21481d268624d5505963058e7fa10748a57c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 617aad709ac7d66890968766cc4b21481d268624d5505963058e7fa10748a57c
  
Dropping
MD5 bbec860047a8e57d464f8ca00ba3dd9e

Comments