MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec972c728bfffe859f0e3b4eab2e08964b275c4efbc86aa05d4bc5a3f429b6d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 6 File information Comments

SHA256 hash:	ec972c728bfffe859f0e3b4eab2e08964b275c4efbc86aa05d4bc5a3f429b6d9
SHA3-384 hash:	72d84e174b44e07b0dc6aa0d97f93e842e01a00047b3c2f73c58b76facd8519abc5c9e97fc8ffaa5ed17fb658143f3ed
SHA1 hash:	90b7d1033310dc806d929d03dfd6f67a0b0514bb
MD5 hash:	31e6773d15eda580670dc443d5d8f08c
humanhash:	colorado-zulu-may-seven
File name:	QUOTE.gz
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'181'042 bytes
First seen:	2023-04-11 06:16:33 UTC
Last seen:	Never
File type:	gz
MIME type:	application/x-rar
ssdeep	24576:x8/9/G45fHQZFodMvO5b1B9QepIToA7y3+b9W+rXgxLII:u/G45P+vm5rDonhnlI
TLSH	T1C9453304C0717CEED7AB20FC40CA851396DDFA29085B9A8A17F3A7D3359B109F25AD93
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla gz QUOTATION

cocaman

Malicious email (T1566.001)
From: "George<guangzhou@neobioscience.com>" (likely spoofed)
Received: "from neobioscience.com (unknown [103.14.224.79]) "
Date: "10 Apr 2023 17:16:36 -0600"
Subject: "QUOTATION"
Attachment: "QUOTE.gz"

Intelligence

File Origin

# of uploads :

# of downloads :

142

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	QUOTE.exe
File size:	2'321'408 bytes
SHA256 hash:	064cc8f4cf0bd367530bfc8a6d541e40a3120845252fe8c82a53f45d6a40e270
MD5 hash:	f232b72d7165ea776ca9a624b40d9b25
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6434fb5f0dbc8763b8a1070d/reports/d8c0f157-3f05-487b-861a-0f6e53164342/overview

Verdict:

Malicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/ec972c728bfffe859f0e3b4eab2e08964b275c4efbc86aa05d4bc5a3f429b6d9

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ec972c728bfffe859f0e3b4eab2e08964b275c4efbc86aa05d4bc5a3f429b6d9/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5slsy4ul777ilhyohnhkwlqiszfsoxco7pegvic5jpc2h5bjw3mq._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230411-jvzv4sch6w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	MSIL_SUSP_OBFUSC_XorStringsNet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:	https://github.com/dr4k0nia/yara-rules

Rule name:	msil_susp_obf_xorstringsnet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it