MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9f83c3846cb77a82a67e231f5d770d805f486cf602798b3d4d4444255bb87ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 8 File information Comments

SHA256 hash:	f9f83c3846cb77a82a67e231f5d770d805f486cf602798b3d4d4444255bb87ef
SHA3-384 hash:	03784cd0c79a7b5660a2cca35a261cea94f22be6bb8e0f61db430358a28da03949364b05c5079b14695d4147b576e83c
SHA1 hash:	96d1786135463ac8342694cf617d6b34612b0266
MD5 hash:	423cd5b549c2872857367db133b960a4
humanhash:	grey-berlin-steak-magnesium
File name:	PURCHASE ORDER.zip
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	262'836 bytes
First seen:	2023-07-03 08:14:58 UTC
Last seen:	2023-07-03 08:15:23 UTC
File type:	zip
MIME type:	application/zip
ssdeep	6144:lpU8PLxNSraik7I/knzPvRPMwrmqFb3P7c1lb0mf3aD47:7PLxNE3lsnTRPMwrmqV3DUlAOaM
TLSH	T1B14423C65DB3B2BA684A67487A1B7E69F12D3881D71FFF4055B20148C8098DF838DA76
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	AgentTesla zip

cocaman

Malicious email (T1566.001)
From: "<praful_pawar@calyxindia.com>" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [185.222.58.244]) "
Date: "3 Jul 2023 04:44:54 +0200"
Subject: "RE;NEW PO 52674-1 TM TOP, DEL 13/06/2023 (URGENT REQUEST)"
Attachment: "PURCHASE ORDER.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PURCHASE ORDER.exe
File size:	277'644 bytes
SHA256 hash:	156c6d57b228e6b5a8920f268f26b70b5fb6ec53b255f102f2dc9f7fa21c9097
MD5 hash:	664fc03c56695b1fe1cfa34159cc36dd
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Zip_fs3213.UNOFFICIAL

Sanesecurity.Rogue.0hr.20230703-0339.UNOFFICIAL

Sanesecurity.Malware.22360.ZipHeur.UNOFFICIAL

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/f9f83c3846cb77a82a67e231f5d770d805f486cf602798b3d4d4444255bb87ef/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

control lolbin masquerade overlay packed shell32

Link:

https://www.filescan.io/uploads/64a2838751710bcd8d43eeed/reports/7c6b3667-bb67-408c-a461-caf6a6f504a0/overview

Verdict:

Malicious

Labled as:

Suspect-BW

Link:

https://www.hybrid-analysis.com/sample/f9f83c3846cb77a82a67e231f5d770d805f486cf602798b3d4d4444255bb87ef

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/f9f83c3846cb77a82a67e231f5d770d805f486cf602798b3d4d4444255bb87ef

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f9f83c3846cb77a82a67e231f5d770d805f486cf602798b3d4d4444255bb87ef/

Threat name:

Win32.Spyware.Negasteal

Status:

Malicious

First seen:

2023-07-03 04:12:37 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7h4dyocgzn32qkth4iy7lv3q3ac7jbwpmatzrm6u2rceevn3q7xq._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/230703-lc2m4aha9x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f9f83c3846cb77a82a67e231f5d770d805f486cf602798b3d4d4444255bb87ef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	MSIL_SUSP_OBFUSC_XorStringsNet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:	https://github.com/dr4k0nia/yara-rules

Rule name:	msil_susp_obf_xorstringsnet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it

Rule name:	pe_imphash Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1 Create hunting rule
Author:	Florian Roth
Description:	Detects characteristics of suspicious file names or double extensions often found in phishing mail attachments
Reference:	https://twitter.com/0xtoxin/status/1540524891623014400?s=12&t=IQ0OgChk8tAIdTHaPxh0Vg

Rule name:	SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects characteristics of suspicious file names or double extensions often found in phishing mail attachments
Reference:	https://twitter.com/0xtoxin/status/1540524891623014400?s=12&t=IQ0OgChk8tAIdTHaPxh0Vg