MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 044233e16f3e3ff7dcdeab11bfa49a9e99c943f2f97ee293705e45b9558c2bbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 044233e16f3e3ff7dcdeab11bfa49a9e99c943f2f97ee293705e45b9558c2bbb
SHA3-384 hash: 5c534bba640eaa739877837e9044aa5de0f8af78a2d4675f50c26e6a4c40758416732b0fac515bfe7d1cb0899b806b7e
SHA1 hash: e982c00b580b22d6a6ced5a2521e6e8143866db4
MD5 hash: e007d1568a3042a91c28c57734d1a5fd
humanhash: august-oregon-blossom-nine
File name:PO.xll
Download: download sample
Signature AgentTesla
Create hunting rule
File size:566'784 bytes
First seen:2022-04-25 15:23:42 UTC
Last seen:Never
File type:Excel file xll
MIME type:application/x-dosexec
imphash a31761b5a590c4c499d5f4a347d75c12 (23 x Formbook, 17 x AgentTesla, 6 x RedLineStealer)
ssdeep 12288:Vn/zDvGHAykHSzLW/4+8bzbBSreMdmhgFK/UqWl:ZzbGHAzHAjX1JcLl
Threatray 68 similar samples on MalwareBazaar
TLSH T124C48D57F7C7FAB0E6BE827A86B1891C527774520260A78F674072896D23392493DF0F
TrID 58.0% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
34.3% (.OCX) Windows ActiveX control (116521/4/18)
3.0% (.EXE) Win64 Executable (generic) (10523/12/4)
1.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.3% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:AgentTesla xll

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis4EBC548DF517.17970.15145.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Office Add-Ins - Suspicious
Link:
https://app.docguard.net/044233e16f3e3ff7dcdeab11bfa49a9e99c943f2f97ee293705e45b9558c2bbb/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed packed
Link:
https://www.filescan.io/uploads/6266bd29fac433a7cc85e5a3/reports/d165c0e8-f148-46ee-9a9d-530fc855b2a4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/044233e16f3e3ff7dcdeab11bfa49a9e99c943f2f97ee293705e45b9558c2bbb/
Threat name:
ByteCode-MSIL.Trojan.ExcelAddin
Create hunting rule
Status:
Malicious
First seen:
2022-04-25 11:41:30 UTC
File Type:
PE+ (Dll)
Extracted files:
3
AV detection:
21 of 41 (51.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=arbdhylphy77pxg6vmi37je2t2m4sq7s7f7ofe3qlzc3svmmfo5q._file
Verdict:
unknown
Similar samples:
0838b673be73014ff6e29d784247ad3b44a794dd2134301bb25c8dd0a3f5b0ae
AgentTesla
2cbcfdf0d8239ed8393f3d4c9f9641bf03aa786a4f7814dcf62bdd8633f75bbf
AgentTesla
37012ef7ec01987ac9bf31695805f4500f6cfac383817767da456ba8adc5d531
AgentTesla
5f1beab27690a8ea9b9be78c5d34dd852dd3af4f5128feace84d1b2e10d73b59
AgentTesla
983ffa1a7513ab6d015e1c4785bda2a2f20a47bf6091773db9341ebcdaf84e93
AgentTesla
bad6f26cf307cd6cf4676a6686a633898880cd90b9e04506e55c708f5a1a93bb
AgentTesla
c7ecbd646727c85760706a61c2283909c13cb5cd80f51f3ce5af83ed438d293d
AgentTesla
dba5353ab99e0d16f30cf5ee5f1f160493b9a9b6364c71197e573f81e4145e75
AgentTesla
df51d17576e6b5ff7488221079a6d0beb42cebf347c7ea04f4b07f2188863a16
AgentTesla
e230c4b82bc8c591ef3c4c5bccb49baffd3f04230eab9342afa5216ab6fa5d5f
AgentTesla
+ 58 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220425-ss225aggam/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Loads dropped DLL
AgentTesla
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/044233e16f3e3ff7dcdeab11bfa49a9e99c943f2f97ee293705e45b9558c2bbb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb
Create hunting rule
Author:@stvemillertime
Description:Searching for PE files with PDB path keywords, terms or anomalies.
Rule name:pdb2
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments