MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 063e5413bfb5efb971cbc2c0139545f8c84a547ccb225a5c297fb8b39a8a5863. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	063e5413bfb5efb971cbc2c0139545f8c84a547ccb225a5c297fb8b39a8a5863
SHA3-384 hash:	c955ac89cf8d15bdee1c757ea1c9c09de952f0ed4e1fa4db24688b24d403385d9b6b34afd805a421df54eb4b4a32247a
SHA1 hash:	8de747f502d00782f177377f666477e23f3a51de
MD5 hash:	b1bf4dbc0634e6c3b0c815147ed5a309
humanhash:	cat-march-finch-lamp
File name:	NEW PO#243 & PO#245.exe
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	923'648 bytes
First seen:	2023-12-19 16:38:16 UTC
Last seen:	2023-12-19 18:19:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:fZRc7aGux+qhLDcxUtkFaRfLWfh3ByxoA9JaTcbir8BadYm/3eHl3V3:3YaG0h3cBFMwhxyxwvQBaOmfYlZ
Threatray	1'485 similar samples on MalwareBazaar
TLSH	T18515F53C99BD2227A4B5EAA2CBD48837F520996B311D6D7598D3C355730AE4338C363E
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	TeamDreier
Tags:	AgentTesla exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

300

Origin country :

DK

Vendor Threat Intelligence

CAPE Sandbox AgentTesla

Detection:

AgentTesla

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/468545/

ClamAV Detected

Detection(s):

Porcupine.Malware.58887.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6581c72ceabaed07017191d7/reports/ac6679f7-ed1a-4036-8fa0-116aaa166046/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/063e5413bfb5efb971cbc2c0139545f8c84a547ccb225a5c297fb8b39a8a5863

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Agent Tesla

Malware family:

Agent Tesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ac507055-defc-4292-be88-467c5d676d2b

Joe Sandbox AgentTesla

Result

Threat name:

AgentTesla

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1364682

Signature

.NET source code contains potential unpacker

.NET source code contains very large strings

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/063e5413bfb5efb971cbc2c0139545f8c84a547ccb225a5c297fb8b39a8a5863

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/063e5413bfb5efb971cbc2c0139545f8c84a547ccb225a5c297fb8b39a8a5863/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-19 07:40:43 UTC

File Type:

PE (.Net Exe)

Extracted files:

12

AV detection:

18 of 23 (78.26%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ay7fie57wxx3s4olylabhfkf7deeuvd4zmrfuxbjp64lhguklbrq._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

1292e02042c5db77d2c7923f2b594d1fb93d7df98232bba8462eb805cd2c56ed

AgentTesla

478c23cab01ee3f4468f1069d0d09a669770889ad4a2bf3e572b6648a53d7139

AgentTesla

612feeb54c4ec909565f21150e17e1f16ee3d584bad954ebdbc8ecda5b3f964f

AgentTesla

9a4c5d776f205dcb2ef261654ebdc4b5ef42a31e2750a84150a3af05fb847c0a

AgentTesla

f31bb7435b6f8828e77f9abcf151a84db7d2bf965443682f79e0e223be7c86ca

AgentTesla

+ 1'475 additional samples on MalwareBazaar

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/231219-t5ye5sfgbk/

UnpacMe AgentTesla MALWARE_Win_AgentTeslaV3 win_agent_tesla

Unpacked files

SH256 hash:

5211c22056dafeec1e7cad1e861c908ba0274f77ab4ea67b3e120aa1d2f39af3

MD5 hash:

fbdf27f3b651e7858f311484795b4c1d

SHA1 hash:

d618cc9a2d35cb79c0466a11d024447ed17224dc

Link:

https://www.unpac.me/results/3f90dd4b-ee9e-4198-81a8-2cd749f466f9/

SH256 hash:

d01f3dea3851602ba5a0586c60430d286adf6fcc7e17aab080601a66630606e5

MD5 hash:

579197d4f760148a9482d1ebde113259

SHA1 hash:

cf6924eb360c7e5a117323bebcb6ee02d2aec86d

Link:

https://www.unpac.me/results/3f90dd4b-ee9e-4198-81a8-2cd749f466f9/

SH256 hash:

c5328f7af843244b56d6a208c322a9315daea139d1b255cda993b243e4394ecf

MD5 hash:

160f4669c06c6496d79a92ea9d33e89b

SHA1 hash:

baae226fdb2a9739f118db781bdc74f2efc6a585

Link:

https://www.unpac.me/results/3f90dd4b-ee9e-4198-81a8-2cd749f466f9/

SH256 hash:

ac5a7a609440f3fdbe118482cdc8deae1f9fecafd49edccc7654ae9f4891de7e

MD5 hash:

20a448eb40cd823a9f74645a265f39b1

SHA1 hash:

1f6bfd2c689a4fea4c871e3d621af31236571bb7

Detections:

AgentTesla

Alert

Create hunting rule

MALWARE_Win_AgentTeslaV3

Alert

Create hunting rule

win_agent_tesla

Alert

Create hunting rule

Link:

https://www.unpac.me/results/3f90dd4b-ee9e-4198-81a8-2cd749f466f9/

Parent samples :

a32cc8da552fd3d712d136c6a102b5f932c0dbd857b1c8cde8258a85f581da63
2ba1ea310eaf97aa16bc1138e39bd981b51dee655baa6f624e890b7564fca2cc
49aa45b9a4eb9642dc458e079196600823bc99b49c9003b4327261ba47b3ae7d
85bb676dfb4011d87bf6199908f8caf38b754ae150eb04ed6792e509800c337e
53f61c62db702e9da5d983db2cd120f697a8814a42820f6237e461e8650b20cd
5210579177775a3f6ea94ad159336e9a153bdf211e672e1536902934f5ef1a65
daaccf41b392b7619f284cf62dc713cfb8af98b561f4af29a78ee718cf579a56
c8bfbf1eff8a047dac6164e46bd28eeb8fbf3dccac544e7853fce271bce75060
172100832947be8421d9001eeb61253c61fcfcd0922623dffd15a2fae3ff9625
47f5f97b2bd40c59992eeba640da3a57c5df13ad8286914f5a823ca0a4d3e9db
198a27bb3eafb16e85363be12dc849311bc4e25043794c5ee1364f2422dbdf4d
9f70a7419f291c5da7a1c68ac575d0490deb69ef4109e71c24d887ebc8114ae8
9a4c5d776f205dcb2ef261654ebdc4b5ef42a31e2750a84150a3af05fb847c0a
478c23cab01ee3f4468f1069d0d09a669770889ad4a2bf3e572b6648a53d7139
f31bb7435b6f8828e77f9abcf151a84db7d2bf965443682f79e0e223be7c86ca
1292e02042c5db77d2c7923f2b594d1fb93d7df98232bba8462eb805cd2c56ed
612feeb54c4ec909565f21150e17e1f16ee3d584bad954ebdbc8ecda5b3f964f
063e5413bfb5efb971cbc2c0139545f8c84a547ccb225a5c297fb8b39a8a5863

SH256 hash:

063e5413bfb5efb971cbc2c0139545f8c84a547ccb225a5c297fb8b39a8a5863

MD5 hash:

b1bf4dbc0634e6c3b0c815147ed5a309

SHA1 hash:

8de747f502d00782f177377f666477e23f3a51de

Link:

https://www.unpac.me/results/3f90dd4b-ee9e-4198-81a8-2cd749f466f9/

VMRay AgentTesla.v3

Malware family:

AgentTesla.v3

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/063e5413bfb5/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/063e5413bfb5efb971cbc2c0139545f8c84a547ccb225a5c297fb8b39a8a5863

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

exe 063e5413bfb5efb971cbc2c0139545f8c84a547ccb225a5c297fb8b39a8a5863

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/468545/