MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0e16bcc402320e88c46b979a2e89802c4bc4c59deb41e59c9040f36b442d870. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0e16bcc402320e88c46b979a2e89802c4bc4c59deb41e59c9040f36b442d870
SHA3-384 hash: d985efd0847063c3b6392ddffbc20700a5485c7735ec3e1bb9185318c53f301801091d033e72934d46959a1d68662e4f
SHA1 hash: acc99f0effb157b805a5a3d7ffc1c20158b56797
MD5 hash: 042e8bcde17c982e429e28c1c2869f1c
humanhash: butter-ten-equal-oxygen
File name:PO#TKHA-A88160011B.pdf.lz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:504'685 bytes
First seen:2023-05-13 09:37:59 UTC
Last seen:2023-05-13 09:45:32 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:xmL/Y8wTmtxYgsX0CXJlaP56U52krSrJkIDem6iJH9dXfMdcCa41a9XCUmm6IRlm:xA/Ybm4Paxl2tkIDejkH9dv15C1EzVGH
TLSH T1DCB423A79310B264D562FCC1693FED966611F89CB7802EE6C09B809DFF7614E19732C2
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:AgentTesla lz rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Haiyan Zhao <sales@seahonest.com>" (likely spoofed)
Received: "from seahonest.com (unknown [45.137.22.121]) "
Date: "12 May 2023 17:28:29 +0200"
Subject: "PURCHASE ORDER-PO#TKHA-A88160011B"
Attachment: "PO#TKHA-A88160011B.pdf.lz"

Intelligence

File Origin
# of uploads :
9
# of downloads :
375
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:PO#TKHA-A88160011B.pdf.exe
File size:580'608 bytes
SHA256 hash: 067aca62f68ca0996bca1267c8fec3859a412a514db8878808bfd576359f5ee9
MD5 hash: 0b5240eef23839c5f50d033c76c43177
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.28929.RarHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Sanesecurity.Rogue.0hr.20230512-1535.UNOFFICIAL
Create hunting rule

Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/f0e16bcc402320e88c46b979a2e89802c4bc4c59deb41e59c9040f36b442d870/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/645f5a7bfe2f8f2723bacd79/reports/7182a750-40cd-4b29-a6b7-b15d7fb88cf4/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f0e16bcc402320e88c46b979a2e89802c4bc4c59deb41e59c9040f36b442d870
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f0e16bcc402320e88c46b979a2e89802c4bc4c59deb41e59c9040f36b442d870/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-05-12 09:15:13 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
19 of 36 (52.78%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6dqwxtcaemqordcgxf42f2eyalclytcz322b4wojaqhtnncc3bya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.54
Link:
https://yomi.yoroi.company/submissions/f0e16bcc402320e88c46b979a2e89802c4bc4c59deb41e59c9040f36b442d870

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:msil_susp_obf_xorstringsnet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_RAR_with_PDF_Script_Obfuscation
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:Internal Research
Rule name:SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4
Create hunting rule
Author:Florian Roth
Description:Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f0e16bcc402320e88c46b979a2e89802c4bc4c59deb41e59c9040f36b442d870

(this sample)

AgentTesla

Executable exe 067aca62f68ca0996bca1267c8fec3859a412a514db8878808bfd576359f5ee9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 067aca62f68ca0996bca1267c8fec3859a412a514db8878808bfd576359f5ee9
  
Dropping
AgentTesla
  
Dropping
MD5 0b5240eef23839c5f50d033c76c43177

Comments