MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 312725334752c3728679010798e68be9b562765a32a9813258323885e732f010. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 312725334752c3728679010798e68be9b562765a32a9813258323885e732f010
SHA3-384 hash: 8e6fd6913bc27d1e5dd506e0a2856587227c0b9185a5162c3ce7a61d6c3f096d6aa20982255f5705fdc8c53457d58338
SHA1 hash: ca7c1aab5af334ac357d11523b2d414c54fe5689
MD5 hash: 3942b37296263a608c746eb06574427d
humanhash: one-uncle-stairway-twelve
File name:PO 9632 CARINA HOMEGOODS,pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:219'648 bytes
First seen:2023-09-14 09:27:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 3072:gDxQNQ/ZrC9RwbulLr5Lb71hEbaFSkjiRrPY:gDxQNQ/ZrKubaLr5L6a+
Threatray 14 similar samples on MalwareBazaar
TLSH T122246A74A1F16ACEE896CEB28E60E919FFE71C519A05420FD13239F6553BB85C6040FE
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 10808a8c8c8a8010 (77 x Formbook, 51 x AgentTesla, 44 x RemcosRAT)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
298
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
PO 9632 CARINA HOMEGOODS,pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-09-14 09:29:44 UTC
Tags:
opendir loader agenttesla stealer
Link:
https://app.any.run/tasks/31ffe765-78d0-4068-87f4-9caf73cc0e6d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/448598/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.13184.17386.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
confuser confuserex packed packed
Link:
https://www.filescan.io/uploads/6502d2237c054d8c5561b099/reports/13605ae4-02a5-4ac3-bca5-c7077c88edfb/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/312725334752c3728679010798e68be9b562765a32a9813258323885e732f010
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f35fc1bc-bdfb-48cf-948c-b6b6044c3278
Result
Threat name:
AgentTesla, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1307620
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Self deletion via cmd or bat file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1307620 Sample: PO_9632_CARINA_HOMEGOODS,pdf.exe Startdate: 14/09/2023 Architecture: WINDOWS Score: 100 28 mail.aksumer.com 2->28 30 aksumer.com 2->30 32 2 other IPs or domains 2->32 40 Snort IDS alert for network traffic 2->40 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 16 other signatures 2->46 8 PO_9632_CARINA_HOMEGOODS,pdf.exe 15 5 2->8         started        signatures3 process4 dnsIp5 38 194.180.49.211, 49710, 49711, 80 LVLT-10753US Germany 8->38 26 C:\Users\user\AppData\Roaming\...\Bossk.exe, PE32 8->26 dropped 56 Self deletion via cmd or bat file 8->56 13 Bossk.exe 14 3 8->13         started        16 cmd.exe 1 8->16         started        file6 signatures7 process8 signatures9 58 Writes to foreign memory regions 13->58 60 Allocates memory in foreign processes 13->60 62 Injects a PE file into a foreign processes 13->62 18 CasPol.exe 14 4 13->18         started        22 conhost.exe 16->22         started        24 choice.exe 1 16->24         started        process10 dnsIp11 34 aksumer.com 46.20.7.163, 49718, 49729, 49730 AS43260TR Turkey 18->34 36 api4.ipify.org 173.231.16.77, 443, 49717 WEBNXUS United States 18->36 48 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->48 50 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 18->50 52 Tries to steal Mail credentials (via file / registry access) 18->52 54 2 other signatures 18->54 signatures12
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/312725334752c3728679010798e68be9b562765a32a9813258323885e732f010/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-09-14 03:58:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
19 of 34 (55.88%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=getskm2hklbxfbtzaedzrzul5g2we5s2gkuycmsygi4ilzzs6aia._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
4160b16dae4f640dba8de3c1da4446a689e9c7506f24fbf79f6f632184ab8243
AgentTesla
784cda9f8d5a1f70a189644e78f76d69c5b41434ac8ee66f77dff5141f0c4fb2
AgentTesla
88167672eebfd515383196c483aeb2e3fbd5492b1c1e08b644845a38f27d8f0d
AgentTesla
89ee49574b483077f00317a988fe5443ee4b3b3485b2b775e411f4d0235dc8ba
AgentTesla
8a839a1497379639e18a64b3f69f8f1a5d70341a666c91d5a13d24fecd05799f
AgentTesla
a19f1949995aa24c6afd60e3c19b54dd3823322385fe2e80734c09dabdec0131
AgentTesla
b05b1fbd99a50623582c797f7822a94a42251bf066a22417828e3d2a401e9d33
AgentTesla
cacad3326fba09f60283210655c8e9cafddaae194e156cc680db4f98d4920e5c
AgentTesla
d7967a64a0dcd864936c7cff847728dc55b6fe40978c60df5e416d8bd294900c
AgentTesla
e5fa48dcc0604fb10d844d476df30106684af28205a7c150142e0b3bf4ef8687
AgentTesla
+ 4 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230914-lfbwvadf89/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Deletes itself
Executes dropped EXE
Loads dropped DLL
Downloads MZ/PE file
AgentTesla
Unpacked files
SH256 hash:
e4b71911eec9680d024c7da62304f89ad4057f8a1077c1e6f0a3c729a6e3c17e
MD5 hash:
d21ab667eb7a0cc1d583e33d33b6fcc7
SHA1 hash:
e3566fd89a1f9e81e4a6230f3090237b090cca82
Link:
https://www.unpac.me/results/3cb3f3b3-4b17-48e5-81bf-63b77651d104/
SH256 hash:
312725334752c3728679010798e68be9b562765a32a9813258323885e732f010
MD5 hash:
3942b37296263a608c746eb06574427d
SHA1 hash:
ca7c1aab5af334ac357d11523b2d414c54fe5689
Link:
https://www.unpac.me/results/3cb3f3b3-4b17-48e5-81bf-63b77651d104/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/312725334752/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/312725334752c3728679010798e68be9b562765a32a9813258323885e732f010

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 312725334752c3728679010798e68be9b562765a32a9813258323885e732f010

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/448598/

Comments