MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 004fce4327d8c688ce7c8088e60f298079b7cb87443ff7a19a21faf3481ded10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 004fce4327d8c688ce7c8088e60f298079b7cb87443ff7a19a21faf3481ded10
SHA3-384 hash: 4b088cd2ba9b1bdb079986f312cadf73cf2f770e11d399842e0adfc5276fc6201debc7912baaeaff6d015b919325a2f7
SHA1 hash: 3ba5322b5191e951d0d94218959f54c38b7aecad
MD5 hash: ac091ec0bfe236f74bfc6bec4f9f3d5d
humanhash: kitten-wyoming-pip-bravo
File name:PO.xll
Download: download sample
Signature AgentTesla
Create hunting rule
File size:648'704 bytes
First seen:2022-04-26 04:20:26 UTC
Last seen:Never
File type:Excel file xll
MIME type:application/x-dosexec
imphash be710ba34b048ab0098050ccf62e369c (18 x Formbook, 14 x Dridex, 9 x AgentTesla)
ssdeep 12288:K0Ws7IMsR4yVld8bzbBSre1BY4ZyrE7K3yl8PeVooA/AB2LEJZsAQPUqjk:K0bskX1FBY4ZyrE7K3yl8PeVooA/AB2f
Threatray 16'078 similar samples on MalwareBazaar
TLSH T133D46D51BECA6EA1EFBF47B78361D62D1126736E03A0A6CF6603019D3951FC2453EA03
TrID 58.0% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
34.3% (.OCX) Windows ActiveX control (116521/4/18)
3.0% (.EXE) Win64 Executable (generic) (10523/12/4)
1.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.3% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:AgentTesla xll

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Generic-9939833-0
Create hunting rule

SecuriteInfo.com.Trojan.DownloaderNET.312.27193.19952.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Office Add-Ins - Suspicious
Link:
https://app.docguard.net/004fce4327d8c688ce7c8088e60f298079b7cb87443ff7a19a21faf3481ded10/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm greyware packed packed
Link:
https://www.filescan.io/uploads/6267733279c6c1e67d2f8c16/reports/57b40f2e-4d76-4f14-a14e-2fd91a3b7bfe/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/004fce4327d8c688ce7c8088e60f298079b7cb87443ff7a19a21faf3481ded10/
Threat name:
ByteCode-MSIL.Trojan.ExcelAddin
Create hunting rule
Status:
Malicious
First seen:
2022-04-25 23:50:53 UTC
File Type:
PE (Dll)
Extracted files:
3
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=abh44qzh3ddirtt4qceomdzjqb43ps4hiq77pim2eh5pgsa55uia._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0c2a4483319382571e9b470d292d0b4bdd4e7e700ff5722a979e4498c147693f
AgentTesla
19e0b2abf3378d86d1f8d834eaf65f66079bfe64181ec13b50dc115e013b12d1
AgentTesla
1bf8c12c3dadffb6d0b9dfbebd78a15bed670640830c0f41369ea6137c2aeb1d
AgentTesla
4a9683f3b6658f4895cd3d44c4920d77db5dfd410cf0dc188e4f4d2740c24539
AgentTesla
5d45566376f6d2724f2a799784589f52751abf462064bbfb9f5bab134ecd120c
AgentTesla
61fe696f1f01753b90b6054fc390025f644a69a8c85a89dc83ac76cae19f79fb
AgentTesla
727f124333294aaba156840955cbfc6ac7470768c65c1582c5e0dbfcb6f8722f
AgentTesla
864b3cc362f84975007a63ae6f7fa6b4bdcc06f4459195896ebee385443ed44a
AgentTesla
c61b6512d455398c2ff7fa4450c488e7eaeb8aacc01f732d8204ae302e2cc868
AgentTesla
d724eef097700915a348d42dcfa0255e3edb3c644cf8740fd052cddab2c81b54
AgentTesla
+ 16'068 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/220426-eynvssfagp/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/004fce4327d8c688ce7c8088e60f298079b7cb87443ff7a19a21faf3481ded10

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb
Create hunting rule
Author:@stvemillertime
Description:Searching for PE files with PDB path keywords, terms or anomalies.
Rule name:pdb2
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Excel file xll 004fce4327d8c688ce7c8088e60f298079b7cb87443ff7a19a21faf3481ded10

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments