MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 142fb3857b4ca67fa862800dc443d4e405f419e1699d1c31de66d913ef038b15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 17

Intelligence 17 IOCs YARA 21 File information Comments

SHA256 hash:	142fb3857b4ca67fa862800dc443d4e405f419e1699d1c31de66d913ef038b15
SHA3-384 hash:	342b4651e9d5fdc3f0d60142db7fe39218c25956b3017c975863457aee7d553588ee89ec5a5db6ce7c6302502240eb8b
SHA1 hash:	da1c5517b7e838862c71699ce75ba22aeb1bfe5d
MD5 hash:	d64a7545f0864d9318d69811aaca65a5
humanhash:	twenty-virginia-spaghetti-ack
File name:	142fb3857b4ca67fa862800dc443d4e405f419e1699d1c31de66d913ef038b15
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	571'904 bytes
First seen:	2025-04-08 08:34:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	fc6683d30d9f25244a50fd5357825e79 (92 x Formbook, 52 x AgentTesla, 23 x SnakeKeylogger)
ssdeep	12288:1quErHF6xC9D6DmR1J98w4oknqOOCyQfyAuEgnOz4EdAeQI:Irl6kD68JmlotQfyAXsOzNAVI
TLSH	T1A8C4239EDFA7BD4AC69D88F54648CC949E2DD1331E4C67CF837CA10AED267097A09B10
TrID	35.7% (.EXE) UPX compressed Win32 Executable (27066/9/6) 35.0% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 8.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	48d4f4f0f0f0d8c0 (37 x RedLineStealer, 18 x AgentTesla, 9 x SnakeKeylogger)
Reporter	adrian__luca
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

353

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

[__Virus__] NEW ORDER_ TORMENE AMERICANA2025 54500.eml

Verdict:

Malicious activity

Analysis date:

2025-03-27 17:54:31 UTC

Tags:

arch-exec evasion stealer smtp exfiltration agenttesla

Link:

https://app.any.run/tasks/336f6bc5-c11b-440c-8dad-4975c46af43a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f4e1c8e011fe619fad253f

Tags:

agenttesla autoit

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Creating a file in the %temp% directory

Launching a process

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Reading critical registry keys

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

autoit compiled-script explorer lolbin microsoft_visual_cc overlay packed packed packed packer_detected upx

Link:

https://www.filescan.io/uploads/67f4dfd72d430c849e0c8262/reports/c650bdb6-2f0b-4460-a53a-106af8f4f90d/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/142fb3857b4ca67fa862800dc443d4e405f419e1699d1c31de66d913ef038b15

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d8b30af3-84eb-4482-82e7-55b93774a841

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1659554

Signature

Binary is likely a compiled AutoIt script file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/142fb3857b4ca67fa862800dc443d4e405f419e1699d1c31de66d913ef038b15

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/142fb3857b4ca67fa862800dc443d4e405f419e1699d1c31de66d913ef038b15/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-03-27 07:09:56 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 23 (91.30%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cqx3hbl3jsth7kdcqag4iq6u4qc7igpbngorymo6m3mrh3ydrmkq._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan upx

Link:

https://tria.ge/reports/250408-khe6lsssds/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

Looks up external IP address via web service

AgentTesla

Agenttesla family

Verdict:

Malicious

Tags:

trojan Win.Packed.Boxter-10005643-0 external_ip_lookup

YARA:

SUSP_Imphash_Mar23_3

Link:

https://app.threat.zone/submission/ad124185-eaa3-490f-950d-4e367ed9348b

Unpacked files

SH256 hash:

142fb3857b4ca67fa862800dc443d4e405f419e1699d1c31de66d913ef038b15

MD5 hash:

d64a7545f0864d9318d69811aaca65a5

SHA1 hash:

da1c5517b7e838862c71699ce75ba22aeb1bfe5d

Link:

https://www.unpac.me/results/2deeb66b-d8ce-4532-b2cb-bed992e6ea30/

SH256 hash:

ee4c84c937ad8b33d7420d47c27162cbd3110a76c1c84cf5bab651333e74f00f

MD5 hash:

ce98e4498428ea6b84fe94a9f8648ecb

SHA1 hash:

0f0cfe79f495b7a73d5418dccfe90c20bdbd8443

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/2deeb66b-d8ce-4532-b2cb-bed992e6ea30/

SH256 hash:

837fbe9b83e066eb57abc2f94a7bbfa1ce5c6189bdea605a9c74bbb11cdab57a

MD5 hash:

eb34eabec4f015fb2c9d8949545dc480

SHA1 hash:

88a60a7b15406d5fee25f5c174ad0547f6d8bca9

Detections:

win_agent_tesla_g2

AgentTesla

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Agenttesla_type2

Link:

https://www.unpac.me/results/2deeb66b-d8ce-4532-b2cb-bed992e6ea30/

Parent samples :

837fbe9b83e066eb57abc2f94a7bbfa1ce5c6189bdea605a9c74bbb11cdab57a
89d69f0365c11bc349cd92ad79cd3066b2225fe41dc2def83deef2661dea01a2
a745b4a8dbdad5c84183ce33793aac75423bdb99fd3a3fca646fbeb66e1059f2
9a31156b6d7eb6076d0bb4a2f593fc21be304aa9e559547e2ee4a6232608c35e
9897c1f7d4ecf7e68ba31bef6c909543d69c6bbd95a17d061f45ed13f4b92bfd
1723b52fb0a05e96e165eda1385729bc64d02ae86afaaa3d1661637ec2d27192
6c0748b811be208d404f519d342c5d63faa2e0dcfefe64131d6ed500285eb0f4
69b1e423fcc489f982d8aeae0cbeee56140b7d8a8810a8c98a7dee8424c00174
2fc7d83ec6fcdfaa540dd36add9c20c880ff865927530305d736af40c8bbce6c
142fb3857b4ca67fa862800dc443d4e405f419e1699d1c31de66d913ef038b15
ec0b5ee59f4421a87c7f912e1af5f27d9e1ae135ffdc07cdd646d1b877c8c6ec
f3b2e714a23ff2060a9f40f574727b5916363b45266653849d6aa5775a51f051

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/142fb3857b4c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/142fb3857b4ca67fa862800dc443d4e405f419e1699d1c31de66d913ef038b15

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	AgentTeslaV5 Create hunting rule
Author:	ClaudioWayne
Description:	AgentTeslaV5 infostealer payload

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_Imphash_Mar23_3 Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:	Internal Research

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::GetAce
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::timeGetTime
WIN_BASE_API	Uses Win Base API	KERNEL32.DLL::LoadLibraryA
WIN_NETWORK_API	Supports Windows Networking	MPR.dll::WNetUseConnectionW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample