MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 310cca45875cb77640bd15ff405af55de5a00828088722da1681aaa2cc90c931. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 310cca45875cb77640bd15ff405af55de5a00828088722da1681aaa2cc90c931
SHA3-384 hash: a35bb9a9985bf53b0a6887acb51fb2850586485b2594c694da305d75e0301603a1a41174582fa51ce52e22edab46fd2a
SHA1 hash: 97d9ad43c67e142a809c30aad0c7cfcb1b3f1748
MD5 hash: 9e10326d3a0fb15366a0d86362edbaee
humanhash: oscar-orange-batman-eight
File name:57m³ LPG SEMI TRAILER 7 NOS.pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:649'216 bytes
First seen:2023-05-01 00:05:10 UTC
Last seen:2023-05-13 22:43:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:qqnMOztzX9enMIR2FEs5or2n5Rjg7OHG86ic16MYzV+hufeqegQVtZ:qy9XlIaE0w25Rj9z/zMa
Threatray 2'751 similar samples on MalwareBazaar
TLSH T118D4AD535065CD5FFE2ADBB0D1B4FF45A6F1F0B364D1A0241BB9218ACAA9F021E4C52E
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
243
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
57m³ LPG SEMI TRAILER 7 NOS.pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-05-01 00:07:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/813e5274-69fc-473a-81c5-cec21eeb5ce6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/385760/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.1994.16826.10551.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/644f026a5642c9c405e223fd/reports/f96c866a-e046-40d7-b9fa-37c2096cac4a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/310cca45875cb77640bd15ff405af55de5a00828088722da1681aaa2cc90c931
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0ac9b5e8-34e6-412b-b6cc-cb3a11b1c389
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1223841
Signature
.NET source code contains potential unpacker
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/310cca45875cb77640bd15ff405af55de5a00828088722da1681aaa2cc90c931/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-04-28 10:58:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
18 of 24 (75.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gegmurmhls3xmqf5cx7uawxvlxs2acbibcdsfwqwqgvkfteqzeyq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
333bc1da1ebac150e52df580ad487c35d31caa25bcdd8e06dd1579cd6dd86019
AgentTesla
5d6eb27a75b5149750cb2891e26f18aa808f2cfe9dd633777028bbcbbce10105
AgentTesla
8612a4be1e824a7d1062b9c37210e39cfd3677970b859ca80a46e8a1e7e424d2
AgentTesla
8d41a5c262bd9bcdde87d6ee9322abebe831a18a143089576b7be05b985aff0e
AgentTesla
9d1779f9a627d5d1cd19c2a1f74f71eddb92cc11d8757d4ea3a2e7b315f4186d
AgentTesla
9e9271e281e82549c613d3aba4a0603536a63c960bf42c16302f6b7668de0d78
AgentTesla
a85d2aa65e5b5d69769ff7dd1a63e90de9bd7f96a76fa96c52137587b63d1016
AgentTesla
dc9592028314f25ba440ef8629468e39714188cdd0d681e76d2e8222bec8978c
AgentTesla
+ 2'741 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230501-adq27sdg41/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
AgentTesla
Unpacked files
SH256 hash:
af0925e4c632166ff87032bc43ea4f85a3805db3782a49724d125f44c0731114
MD5 hash:
b9897ba5e468e516e162fd3790a9ddbc
SHA1 hash:
db264c796e4a36a45af11e8a7bf71cf0dadce0f0
Link:
https://www.unpac.me/results/1ec59039-cc35-40d5-bdc3-fbf98960c94b/
SH256 hash:
81bc2950bd9a90e4c8d16cca1547fff7f70e4721bdf6b56ce0c31a75ed35d5da
MD5 hash:
662463178c235071f18fa9443c67baf3
SHA1 hash:
a5587b8b347bef8ecde127fcb34b3d12ef26e05a
Link:
https://www.unpac.me/results/1ec59039-cc35-40d5-bdc3-fbf98960c94b/
SH256 hash:
23f0988a2516bbed0cc362a6d88b743bc07dc03c92c38ba4e2796cddbd28a9db
MD5 hash:
e23eedd13ea327d25bdebb8dcf8c12fc
SHA1 hash:
63c7b872a816e77e147d4ff5d5706bfa96205872
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/1ec59039-cc35-40d5-bdc3-fbf98960c94b/
Parent samples :
5d6eb27a75b5149750cb2891e26f18aa808f2cfe9dd633777028bbcbbce10105
333bc1da1ebac150e52df580ad487c35d31caa25bcdd8e06dd1579cd6dd86019
9e9271e281e82549c613d3aba4a0603536a63c960bf42c16302f6b7668de0d78
310cca45875cb77640bd15ff405af55de5a00828088722da1681aaa2cc90c931
e446bfc6a1d4e343f6840965abf9d010f5c32e06b188d3d076fd2e3e0b0bab79
c6e74929d1f5df0946833f77f1074f8a8518a642067b129dae1ad261ded796f2
bf97757e1e84e0b3c97e2df6f9262873ab853605d2859ca93852dcb6d24513a9
5726f0ac293bb3dd4a0fce6bd6e7f7d9ded4ecbed55733bab4c91be2e58be478
b9d37d2bd06ca6ea4cfc72d49f30ffab897351e19f4cd31464a2a3314ee642ba
067aca62f68ca0996bca1267c8fec3859a412a514db8878808bfd576359f5ee9
9ade1aaf821812d038b9bab451e0b48fad06c688e738a522e2d3d9947421209a
4581026ca8972214b08a22a0b621d607997da7586b828e02bfab11a5ca5de33f
4ea83aefa492b4ba2b49e13e34023674ed8b50373a9f521dc887178f60b60965
ea334a8065334c73ce7ab24aaf3aa8d2bf400bfcc1389b5859e76348191a43f5
27e36aeb932b11f7f1a9eb8f7cc2ff7cc7d05549d3936aaaf5a6566cfd72166f
256ea055c6552920ec84ce91c5e9caae6bf9ed5a262c1f237adf8be1a99e8272
40247a3716900e213541061e25967670cfaa9415f554228dd6766e93a0def8f5
9ff3cd3ff6bb45bd888b2eaeebef3aef2784182df2ef03449d435098166882ba
d3b064dd11c1c634020c0c155bf9e33c1f0ad2fd8fc85eb1ffd44e05cfd4c291
2bed887fca5ae34bb249eb750e20b7542c9209a169745ad2bd9176618042f8ee
30a2b97369cb49a104c48274ea39b1af4b3a1eb9f8ece684632ee00bc409daeb
6e41de3cfe2a499488f1eae60dc1ba0f35f0e86c2428271e78bc8ddb51e26d0c
af87ecc512fe3271689f7674ab31070633ac5a85b3a5b2ac585068f3127b77c7
427883d7c6eb502e12e7ae65c1d2c241c8815998faea9dcfd9681d8f40f1f665
f37444849fb5d3f512aa399c0ccc8bbac2dac9a725c7965f445cc472f64a727e
23f0988a2516bbed0cc362a6d88b743bc07dc03c92c38ba4e2796cddbd28a9db
4644d82860cef54c8cd84971e923baa8ddc0347375701c7dbf5a884bb1c5771c
5d0e819a624b53524558b2e89007e0a645123a0e401a4dd5c2e5f709730e8f0e
e1836520ed6edb7fe91462076fdba7e96174e4506e7fd2df69de260199e5c020
2685ea1f640c12172fb5e136a624f56fd904627b6523a75c7f9357c0313ec518
a8ee0501ce8a092cc0cdbbfd3572db5c3ad505e054ffc24e4af4b6678726f850
dd9072aa04107fc87a791671e749e9b8833fa7885271e392ee1db9fdd30ff7ef
5f38f51f0ecaf46523adab8c5597af29894278716ebee0e1a87bde9863424b88
0caa683c9f3f6bcad952386397eb6a3e70d5c0f4b2b3d8b144f03a620e81ef0f
4f20ef240b6cd77d44c9515a39f1f9a4f12cdd84a043fa63a9928fd8728e3106
c0fcad9ddeff65354abef66d0d0ff63091aa7a090e7b281514956367d9bcde40
fa77fd0bc332cc52417da2001bbfee518d2d6cb6c363d15e67d1417afe784325
1f3c7beff0c3f2e7f7c21ae2ad886224c71a739c7554ba8f38aa3f9019ec48db
9e7eaf53bfef161396377f312d623d10c49746779710206acbe408496e50d68e
01af6a15beb6d627c8e7d255eb0d8f2e1167d710b101973b8da9b50246368bf3
2c02305910d1d64b8128f8519f65a75a9d33a27cfc21de77bbd087fde9bef580
b723d813af59659cb9a6164a6b1e9e2ec42353ca05272cd3b773282e76fc2385
4f9ab5722f95d20fc30c81bf817157c48c6e3f6e53a5a2881ff846be338eb360
f6ceb475c843b5339bdd85afc176eba77bf0d7a133afa4e092e3cd9e93889a7a
4ffdc291532f5d4d2960372a807b3215c9486d6fb643d09c64fc2ecf23cb31d8
eca31a8b84856348ea97f1a1469c8b34f6afc80b79e5a0d40fca44f2a4139d0f
becf6b9764ef6665d04082b9f4879b9bb1fef8976d752411778b7d83fae74057
9de62e10117526b21be8cded286a1522be0237d4b6e24d51d5bef8cd66cf7eb4
47dfb65b3426e320eb7e9ba01ab8fe1e12bc00ffc217f148676638823978c350
4bd728557c59a4ab89a5d3bd881603e69fa41247bab33f22d95404e532b21b24
fcd1fb8ea7cf43f01388e7763017ff869ccd345ce8d4cebfd9b97dbd2496520f
ed3e5af47aca29408248c203ccc55369d5c8e1c7d468b613fd3993fdec39eb08
4b521275a1d1b0a5c527419333dddda642148dde8cefd4fb9a8e4657848844b3
d8c86642c4e7e86d3591143c9bd7a7ca0278ed8812908b81e5633948ebee2eee
ee87b91b6480592bf45354a624ef6b478ed812f5ef33e36dbb6775fe057dbcfa
b68d03062282d38f52d9c19540ec2e1ec85eb501fac42d5ac64c4f77b1e087c1
d7c1ff8739d0d26e441b0828edd8e77700a97d19231d1cf0dbb105735f793ef0
ac3f1194d74f5cc87908936d768285d75e7df2171b653271a59568399b0753de
2af7b3022340dcc9a68e42e7b6c429e12923b62f81a36bb59e61a6121fdf2052
1cbbef03f82222e64ba32d7834fc6d1718b5cdb7f2f9b90ccf7d0732a95615f6
e9f611aaae38af4a81b3dda7c5997a4c8e852b6b87f4462b70bf5b5fa016e584
c7d5597ac8ed4d56434f101e6fe02c9ef5482f36502fa5b4f764b52ea643a5da
c70c391c3da0b64bb0f82437b3ebe6b18efa3cf871c2d890820725a060474bf1
abd4a743c4aa8fb625f1af14edc51606fc1b8e1a15396d9db706c1fd3cf41395
73d86b4c5e0ec35d75e6d81fa0244f5320a267b34fa37b12f5d548958c9390f4
b95ca7569939cdab51f2d7f4b20e8d76cb94a08b26e38aaedf4d6d84faf7d12b
SH256 hash:
e5518e76f14e87bcc58a705c6f8f3a686cbffefc0e55985d17a067adfddf3688
MD5 hash:
920a2854e9c183ad2ef7d5543c296d38
SHA1 hash:
2c20da753bdf6f1a46261e2c132dd42f75c94229
Link:
https://www.unpac.me/results/1ec59039-cc35-40d5-bdc3-fbf98960c94b/
SH256 hash:
dfe37af92841e58608d562d305477bfee702976be9eeee4dfe2241bc2136a09e
MD5 hash:
7f1720d3f02f76c09e0744c5e3164644
SHA1 hash:
20702f5a15103f7b54b7ad1a213a860ac126caf9
Link:
https://www.unpac.me/results/1ec59039-cc35-40d5-bdc3-fbf98960c94b/
SH256 hash:
310cca45875cb77640bd15ff405af55de5a00828088722da1681aaa2cc90c931
MD5 hash:
9e10326d3a0fb15366a0d86362edbaee
SHA1 hash:
97d9ad43c67e142a809c30aad0c7cfcb1b3f1748
Link:
https://www.unpac.me/results/1ec59039-cc35-40d5-bdc3-fbf98960c94b/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/310cca45875c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/310cca45875cb77640bd15ff405af55de5a00828088722da1681aaa2cc90c931

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/385760/

Comments