MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46f0e45dbbf592ca7ed929b193254ece1cc22c3719888b8aafc32685dcd64f5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46f0e45dbbf592ca7ed929b193254ece1cc22c3719888b8aafc32685dcd64f5e
SHA3-384 hash: 3cd1035b22339cf2416baa45d72ca19bb10332e026c00be69197940e1211d4fa509ad504cac832fb9a80555efb9973ad
SHA1 hash: e9d8dadcf12189203176149e65ef5312afffcadf
MD5 hash: ba14c131aec75dc05000625a987eb13e
humanhash: bluebird-arkansas-golf-steak
File name:RFQ 18757_PDF_________.EXE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'190'912 bytes
First seen:2021-07-01 10:25:24 UTC
Last seen:2021-07-01 10:59:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:0mhzhKWZXXiNSVCPFMMVjR4bkzVLa4hx:/hzhvZXXdArjR4ozVLph
Threatray 6'513 similar samples on MalwareBazaar
TLSH 1745E00BF6099B45C8541238CCEFC2741375EDDB78138B1B2A997BED3CB2622CD556A8
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ 18757_PDF_________.EXE
Verdict:
Suspicious activity
Analysis date:
2021-07-01 10:30:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e06f33f9-dbda-4359-9dc5-a45422d1d3a3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/169127/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46559897.19208.9299.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7a354ebe-2123-4e5c-94d2-ec97710f691e
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/810483
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Suspicious Double Extension
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/46f0e45dbbf592ca7ed929b193254ece1cc22c3719888b8aafc32685dcd64f5e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-01 05:29:02 UTC
File Type:
PE (.Net Exe)
Extracted files:
51
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i3yoixn36wjmu7wzfgyzgjkozyomelbxdgeixcvpymtilxgwj5pa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
149e5cb565e56469e6ff5c929185e203c92be0d8541faf0cf38da0003ae211d3
AgentTesla
666fe2e09369d8214863bd500c047ce721d9175b1208d0544339d2f904fa21e3
AgentTesla
a05b237bd950b290bde604ee1eb0682268195ce28a92dfc1b17c5085583dd107
AgentTesla
a5b4a1aa53134e93a392b7b90cc7c5d4a939d4f61bdf330de08d49fa1b4356ed
AgentTesla
af37541da5e2d0122834a4f1b8debc68a56a5bb674fa34519d7bf25be0357132
AgentTesla
b4dc60b514403aaa01b862023671629d5db9836642e56bd618a3b77052fd7fc9
AgentTesla
d04a849e7e6fdf8b031ffe8db276f8dd315cd38f622ae9dc9fbf2168a9183f51
AgentTesla
d3f8e4451246f36e47a5f5d2624e5b6b1ec08b5fc2fc4df6080b40f5e13edec8
AgentTesla
efc33e49a1f2bb8a2caf20a3609c44170c3739c90c1e2f4f236961e13279a3b3
AgentTesla
f90cf6686fcfe69bb074cf65a5b7e19c8e97b1351377faa7a2477577d4171de8
AgentTesla
+ 6'503 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210701-624c62rpdn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
1c5e0a0d909d1da24af87967a1e154c8aa490a1f99c6624e7214d20eb84f4fec
MD5 hash:
81faf15c7e3c9446d906659f7c7a9f16
SHA1 hash:
d7e05a22b109ce608109dc509029a7fe22b4b8bf
Link:
https://www.unpac.me/results/0a84c911-9628-4966-83b5-59bd5528af57/
SH256 hash:
f29bb74de6afa8e4f7cef13a6e35ec9ed7ceef4fe13e86c4f47f0c2914185814
MD5 hash:
e093ea526de2e984d42b832da025c118
SHA1 hash:
a51a6abe5005f6a34e92ebc1d3b0e6079445b6eb
Link:
https://www.unpac.me/results/0a84c911-9628-4966-83b5-59bd5528af57/
SH256 hash:
424c00b45a2e5e95a7cc89bd661f81981200ab681e04843b7650bc07bd10436f
MD5 hash:
3dea47f724b5e989424b45a61627f573
SHA1 hash:
16c7a37db11c77e4bd61168427ae2536986714a5
Link:
https://www.unpac.me/results/0a84c911-9628-4966-83b5-59bd5528af57/
SH256 hash:
46f0e45dbbf592ca7ed929b193254ece1cc22c3719888b8aafc32685dcd64f5e
MD5 hash:
ba14c131aec75dc05000625a987eb13e
SHA1 hash:
e9d8dadcf12189203176149e65ef5312afffcadf
Link:
https://www.unpac.me/results/0a84c911-9628-4966-83b5-59bd5528af57/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/46f0e45dbbf592ca7ed929b193254ece1cc22c3719888b8aafc32685dcd64f5e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 9ff203c1fe2e11952de2655d7e830a1d59b87ceedc39cfe6fe2420be49f99bae

AgentTesla

Executable exe 46f0e45dbbf592ca7ed929b193254ece1cc22c3719888b8aafc32685dcd64f5e

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 9ff203c1fe2e11952de2655d7e830a1d59b87ceedc39cfe6fe2420be49f99bae
Cape
Cape
https://www.capesandbox.com/analysis/169127/

Comments