MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7a5e844ed82169ead7a0a1cfa698320fb2aee3497926548619c1ed4d0a63dbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f7a5e844ed82169ead7a0a1cfa698320fb2aee3497926548619c1ed4d0a63dbc
SHA3-384 hash:	0a932e2b22345379a9c237adaeff5abd6f1fd88cbd5d849eba423afc745ce3f7a7b571231ad7a31ebde111355d62d21a
SHA1 hash:	9693cd2a9b5d1780e7764f4200af72072d2580fb
MD5 hash:	602586797314cb256c9588bd12606a18
humanhash:	bluebird-washington-cat-saturn
File name:	RQ-2023-E042.pdf.lz
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	596'828 bytes
First seen:	2023-12-18 11:53:38 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:IQ8claChqfUxotskSiwzMDjnes3tmSPHzEAt8F90O2yOhuCnWL2/:IVGaChGfVwzM+s3NEAtu9f2yQb/
TLSH	T106C423C33C36FDDF064FE7C9363D46E762505EE10E096A8923BF20946EE365D659420A
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla INVOICE lz QUOTATION rar

cocaman

Malicious email (T1566.001)
From: "Mohammed Yasser Hyder<kcpurchase@kconceptpak.com>" (likely spoofed)
Received: "from kconceptpak.com (unknown [185.222.58.103]) "
Date: "18 Dec 2023 12:52:47 +0100"
Subject: "QUOTATION INVOICE 09876568"
Attachment: "RQ-2023-E042.pdf.lz"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

111

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	RQ-2023-E042.pdf.exe
File size:	889'856 bytes
SHA256 hash:	73d86b4c5e0ec35d75e6d81fa0244f5320a267b34fa37b12f5d548958c9390f4
MD5 hash:	a12d331159e0ff3a400326dcd7d8eae8
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28929.RarHeur.UNOFFICIAL

Alert

Create hunting rule

DocGuard Unknown

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/f7a5e844ed82169ead7a0a1cfa698320fb2aee3497926548619c1ed4d0a63dbc/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/658032e0b4e856b7281e7016/reports/765e4385-b1fc-44bd-b541-789df604c169/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f7a5e844ed82169ead7a0a1cfa698320fb2aee3497926548619c1ed4d0a63dbc

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f7a5e844ed82169ead7a0a1cfa698320fb2aee3497926548619c1ed4d0a63dbc/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-18 11:53:41 UTC

File Type:

Binary (Archive)

Extracted files:

17

AV detection:

10 of 36 (27.78%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=66s6qrhnqilj5ll2biopu2mded5sv3rus6jgksdbtqpnjufghw6a._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231218-sefa7sbcel/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f7a5e844ed82169ead7a0a1cfa698320fb2aee3497926548619c1ed4d0a63dbc