MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec2684a319f6bfe8314573d56adbce4ca4295415025325e212a2b033580d2a9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec2684a319f6bfe8314573d56adbce4ca4295415025325e212a2b033580d2a9f
SHA3-384 hash: f5bd6a5c2561a3fd5168bb08f8f8aeee829dd6af7d8a906ceb5cb6f4745100f48137cbf613d2c6e99fbdf33959cc34dc
SHA1 hash: d6b67f3bc29068d004793fdc067cb29b502b07d0
MD5 hash: 345009ea29b86f597742de30db3b9801
humanhash: golf-triple-harry-stairway
File name:9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS OILFIELD EQUIPMENTS & SUPPLY.pdf.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:564'880 bytes
First seen:2023-12-07 10:08:06 UTC
Last seen:2023-12-07 10:23:07 UTC
File type: arj
MIME type:application/x-rar
ssdeep 12288:vOUcl6zKtzH8rZuifqj2Lx4RF/riM1Ch+dtPs6rfOkFlJ:6PL8ZT7MF/rzA+dhs6TOKlJ
TLSH T192C423EA06A0D061AC937E2EBAC1BD077504E03856DBD72DB523A22D84C35DE2C12DF6
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:AgentTesla arj QUOTATION


Avatar
cocaman
Malicious email (T1566.001)
From: "ABU OBAIDA ABDUL WAHAB <sales@binhafeez.com>" (likely spoofed)
Received: "from binhafeez.com (unknown [185.222.57.90]) "
Date: "06 Dec 2023 20:06:28 +0100"
Subject: "9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS / OILFIELD EQUIPMENTS & SUPPLY - REQUEST FOR QUOTATION"
Attachment: "9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS OILFIELD EQUIPMENTS & SUPPLY.pdf.arj"

Intelligence

File Origin
# of uploads :
10
# of downloads :
107
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS OILFIELD EQUIPMENTS & SUPPLY.pdf.exe
File size:636'416 bytes
SHA256 hash: c7d5597ac8ed4d56434f101e6fe02c9ef5482f36502fa5b4f764b52ea643a5da
MD5 hash: b4ca199a24f89305f407c5a4cc5c0323
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20231206-1332.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/657199c918cffa73b1dd2cf5/reports/e7a743d6-ef2c-4ffd-8706-e8e520e55f11/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/ec2684a319f6bfe8314573d56adbce4ca4295415025325e212a2b033580d2a9f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ec2684a319f6bfe8314573d56adbce4ca4295415025325e212a2b033580d2a9f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-12-06 07:42:35 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
22 of 37 (59.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5qtijiyz6276qmkfopkwvw6ojsscsvavajjslyqsukydgwanfkpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ec2684a319f6bfe8314573d56adbce4ca4295415025325e212a2b033580d2a9f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV4
Create hunting rule
Author:kevoreilly
Description:AgentTesla Payload
Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:msil_susp_obf_xorstringsnet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_RAR_with_PDF_Script_Obfuscation
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:Internal Research
Rule name:SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4
Create hunting rule
Author:Florian Roth
Description:Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:Internal Research
Rule name:Windows_Trojan_AgentTesla_a2d69e48
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj ec2684a319f6bfe8314573d56adbce4ca4295415025325e212a2b033580d2a9f

(this sample)

AgentTesla

Executable exe c7d5597ac8ed4d56434f101e6fe02c9ef5482f36502fa5b4f764b52ea643a5da

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c7d5597ac8ed4d56434f101e6fe02c9ef5482f36502fa5b4f764b52ea643a5da
  
Dropping
AgentTesla
  
Dropping
MD5 b4ca199a24f89305f407c5a4cc5c0323

Comments