MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfb670e4148832b572b17ca5f5de373158e47c05c76d0fb62483aaabc9e3db57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	dfb670e4148832b572b17ca5f5de373158e47c05c76d0fb62483aaabc9e3db57
SHA3-384 hash:	0bbe50dab8e210143ed41a6f814f5aebe1c978d401a9b9a91ae479cc48250e84f47a1fde24d629d8e099d5660ffb556d
SHA1 hash:	6d8ea51dae0c3d30f697d42c149f517901f530e2
MD5 hash:	88517f571f00bf1fe37519a258243d04
humanhash:	undress-earth-summer-ack
File name:	NOTICE.r09
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	446'968 bytes
First seen:	2023-03-17 08:04:45 UTC
Last seen:	Never
File type:	r09
MIME type:	application/x-rar
ssdeep	12288:+jlpMl6Sx4yR3b4ZFXiobnRqv4D86RV35H4CJ4XrQgK:+r8x4y98fBTgvMRV3/J4cgK
TLSH	T1DD942333E8893F2C19A1503A1875C66F8F92EADCD82E9514ABB170400A7D6219FFF25D
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	r09

cocaman

Malicious email (T1566.001)
From: ""DHL Limited" <air@dookang.co.kr>" (likely spoofed)
Received: "from [212.87.204.165] (unknown [212.87.204.165]) "
Date: "17 Mar 2023 03:16:19 +0100"
Subject: "None"
Attachment: "NOTICE.r09"

Intelligence

File Origin

# of uploads :

# of downloads :

146

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	$45,000.00 USD.exe
File size:	2'596'352 bytes
SHA256 hash:	b499cbf56149c33fc6e105f9121d8c985e5dff6f5e4201184a012673a94b98b4
MD5 hash:	5c4d5da888c4d61825cf4d290a95abf5
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

snake

Link:

https://www.filescan.io/uploads/64141f30109d4db51669ac0d/reports/e52a330c-8bcd-4736-8e5a-1e6155f708fd/overview

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/dfb670e4148832b572b17ca5f5de373158e47c05c76d0fb62483aaabc9e3db57

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dfb670e4148832b572b17ca5f5de373158e47c05c76d0fb62483aaabc9e3db57/

Threat name:

ByteCode-MSIL.Trojan.Generic

Status:

Suspicious

First seen:

2023-03-17 01:03:24 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

11 of 39 (28.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=363hbzaurazlk4vrpss7lxrxgfmoi7afy5wq7nreqovkxspd3nlq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dfb670e4148832b572b17ca5f5de373158e47c05c76d0fb62483aaabc9e3db57

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.