MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1025ea55a0dc2b783a15f4c8d980b63d16a89a1e0fdfce39931de521d76f9f3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 13
| SHA256 hash: | 1025ea55a0dc2b783a15f4c8d980b63d16a89a1e0fdfce39931de521d76f9f3a |
|---|---|
| SHA3-384 hash: | 8bb4340228fdf683628d5877853e14a287e7734d19fe1d124c5edac80d4296e203ea5b7d3ed4fc659314c89e6289a6b4 |
| SHA1 hash: | 1bc8ac9310038f78cf4e7ab74763b80a6af95163 |
| MD5 hash: | 73e8af8237a50fd508e2ea20f321c2ca |
| humanhash: | orange-september-butter-grey |
| File name: | Dhl.doc.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 595'456 bytes |
| First seen: | 2023-05-02 11:35:27 UTC |
| Last seen: | 2023-05-13 22:49:32 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'476 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:DEQ4bmVSISBI955ag4YrBSasjPaca67zPEH+ml:dke9zX4Ykeca67O+ml |
| Threatray | 2'861 similar samples on MalwareBazaar |
| TLSH | T136C4D01A61A4CB5BFD7A8BF09474FF8463F0B07764E5D2242FBA20C6DA96F001E4951B |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  abuse_ch |
| Tags: | AgentTesla DHL exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
260
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Dhl.doc.exe
Verdict:
Malicious activity
Analysis date:
2023-05-02 11:36:39 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-05-02 07:29:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
20 of 24 (83.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 2'851 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
21f0154b51a09767f94922b81f5fcd15cf4a6390ab7314e40d0e17b2dcdfe6ba
MD5 hash:
c926563698de3a89ad20474c85122f73
SHA1 hash:
ed1a3b2527ace111e6f39880c7ee3965f301330d
SH256 hash:
d1731db43aacc0af6d080099259d2d3a5ece3a5b23ed916ebec2c1896b73cb11
MD5 hash:
4b1a220db00cf569cc720b0626548a7b
SHA1 hash:
dca94a7a89c3f637113013bf4f36cbed3abdcb21
SH256 hash:
2133651d9ba8db36079ea952de82d3e69d77132da12ada8c6f45fe9610e0c2dc
MD5 hash:
49dff168bd506c197b401ac9cd77dd68
SHA1 hash:
cd42742068600cd8cb7f25c13cc30e86b5d81a2c
SH256 hash:
ab7bbe315be759999d114ef197f72ae01a99ccfaae3b101dea1e74c8cfff4d73
MD5 hash:
12103e36dcf852fc4b20f2ef0f0edc10
SHA1 hash:
9ae4055b44bacce76dc2f06357460d796f0e5ab6
SH256 hash:
62b46fecccbce5317add50cc6ba8b6e13d68a2dfe4eab43a6e197cf0c28571b7
MD5 hash:
2d9d8241de90d47011b8764e91880f5b
SHA1 hash:
74d7ff1a31e0423485d4bada1710983e3567d417
Detections:
AgentTeslaXorStringsNet
SH256 hash:
1025ea55a0dc2b783a15f4c8d980b63d16a89a1e0fdfce39931de521d76f9f3a
MD5 hash:
73e8af8237a50fd508e2ea20f321c2ca
SHA1 hash:
1bc8ac9310038f78cf4e7ab74763b80a6af95163
Malware family:
AgentTesla
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | MSIL_SUSP_OBFUSC_XorStringsNet |
|---|---|
| Author: | dr4k0nia |
| Description: | Detects XorStringsNET string encryption, and other obfuscators derived from it |
| Reference: | https://github.com/dr4k0nia/yara-rules |
| Rule name: | msil_susp_obf_xorstringsnet |
|---|---|
| Author: | dr4k0nia |
| Description: | Detects XorStringsNET string encryption, and other obfuscators derived from it |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.