MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0451c23deb9a283b5aead1f5a49d95b09e35c21e953eeeec71ff1d71eaecd9f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0451c23deb9a283b5aead1f5a49d95b09e35c21e953eeeec71ff1d71eaecd9f3
SHA3-384 hash: 89ad1259e24f1d8ca2db2627b483d567bc1c326799b2600328598a443462bec8b2fd2f56d2d4cf52009cfbd5a1df0277
SHA1 hash: 4eda0049201b8cffc8838e98a19d4bb0b5cd1a56
MD5 hash: 01881dda6a5a55a0e17b5c721a4edc62
humanhash: six-mexico-thirteen-solar
File name:Carmen Mozzo_pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:479'744 bytes
First seen:2020-10-15 05:10:33 UTC
Last seen:2020-10-15 05:11:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:PTbHDdiSG0ahtIQiqQF3xAxl1JlhTnTbLN:PTrDxahtzi3F3xAr1Jl5nPLN
Threatray 249 similar samples on MalwareBazaar
TLSH 67A49D767D92D97FCE6A0736146584C5FAB612C73B508B0D629E8B0CCE11B2FA743287
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/71186/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.10405.1437.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/491963
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Binary contains a suspicious time stamp
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect virtualization through RDTSC time measurements
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0451c23deb9a283b5aead1f5a49d95b09e35c21e953eeeec71ff1d71eaecd9f3/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 01:21:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ari4eppltiudwwxk2h22jhmvwcpdlqq6su7o53dr74oxd2xm3hzq._file
Verdict:
unknown
Similar samples:
015f0cf04ffdca8141fd57bc67848a21dc11ab2fda0a91627f6deddcde2c0ca9
AgentTesla
0edc105e9bc4e9b297487650e45b6ee0b0ca1e97e2194a2b455d657e428be977
AgentTesla
223c38be022bf37ef243556438ecd472ae67bbb46fcf0e7ce4ea3173260141e9
AgentTesla
4323dbb489f82a5a4906fbc6e0dc37a6589dc7b073f2fa0a569b7d3409314e15
AgentTesla
659c836026b1ee353c16584705804815ea357519b446db36822fb40bed5ab320
AgentTesla
73f6286bd85316cb72796f461e1ad724b8434837f1a10a4a625862c3a7e3c173
AgentTesla
8878c46875d3b0d420bd76508490e5c6df7a55359d1d039f0edb145e836addb1
AgentTesla
8c6c41d8e0f478b1be11b938bf83066e8cf7a8b294c18c91e0b2570f464bc6d2
AgentTesla
d9600ffc9406d71c60b7eb036248230510c3b971a1de563ca7b8b57e822f7879
AgentTesla
f4e60792b136f02c28fd35322ee58bf723aeaa3611d286417d8b2b0707612cdc
AgentTesla
+ 239 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/201015-aql5hmm9dj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
0451c23deb9a283b5aead1f5a49d95b09e35c21e953eeeec71ff1d71eaecd9f3
MD5 hash:
01881dda6a5a55a0e17b5c721a4edc62
SHA1 hash:
4eda0049201b8cffc8838e98a19d4bb0b5cd1a56
Link:
https://www.unpac.me/results/53088275-bc8c-4447-a469-54b49a241a7e/
SH256 hash:
30140c3bf5874d7d184b15513016f9de1524ae95a5efe9a1cb15bad6d6936d64
MD5 hash:
03847d82611bc6461cbb99ca768828f1
SHA1 hash:
39859a3fd3326520dfd1ed10456bb227933a8871
Link:
https://www.unpac.me/results/53088275-bc8c-4447-a469-54b49a241a7e/
SH256 hash:
e8b0e1b9bcb5f5981db0f23359a7ee80b0451856d1eb7f43bfd1dd44230dc9bc
MD5 hash:
7454ef2de2ffc3d5924439b1fa6882c7
SHA1 hash:
4c02d1ead92f2b7b8ea001b85410eef5aaff655f
Link:
https://www.unpac.me/results/53088275-bc8c-4447-a469-54b49a241a7e/
SH256 hash:
39c99a9539b034719e14fbc488c2268a2e935dbd0f1162badf898dbdda4eb12d
MD5 hash:
969c10802f9afcd802e938fb49593827
SHA1 hash:
a02f21f1031be8da4bbeb977a0a02a8bb602da40
Link:
https://www.unpac.me/results/53088275-bc8c-4447-a469-54b49a241a7e/
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
Link:
https://www.unpac.me/results/53088275-bc8c-4447-a469-54b49a241a7e/
Parent samples :
afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660
69e2ae11e1b5cbe120bf02301191a1cf05e87fc09b09d63bd782abbf3615d05d
0b778873c94f6bc89a40294c0e85a38ab82509260cd2a2e8b73d00c5c90e8757
7ddfa6f44a60f4b894321f6977f8121cfb371c3c61ac872c58ba61fd5ee13deb
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0451c23deb9a283b5aead1f5a49d95b09e35c21e953eeeec71ff1d71eaecd9f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 595a20a64d246c2b8e5a6068a5df96d04d909052916e9ee80b51a39ee4fc9605

AgentTesla

Executable exe 0451c23deb9a283b5aead1f5a49d95b09e35c21e953eeeec71ff1d71eaecd9f3

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 595a20a64d246c2b8e5a6068a5df96d04d909052916e9ee80b51a39ee4fc9605
Cape
Cape
https://www.capesandbox.com/analysis/71186/
  
Dropped by
SHA256 2bfbbee95c6b46efe48f560a4ac146802cc173284f6720a8170959c1817e74ac

Comments