MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4860fe0ef130905e083db85110fbe732cb74933dba0567d5b3aa509579f796a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4860fe0ef130905e083db85110fbe732cb74933dba0567d5b3aa509579f796a0
SHA3-384 hash: 73aa9e8ad9c95f59f131fc38aa5a4cdc9aed8348654280b5bb77b696e3213cdc59e1aa009fd7b36335224e2845eaa06f
SHA1 hash: 83494f6e7e8810d426d638d5985c2910cda69e9c
MD5 hash: d721b75d85917803a6fca2c336175ddf
humanhash: sweet-twelve-burger-indigo
File name:DHL_Jan 2022 at 1.40_80BZ290_JPG.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:382'000 bytes
First seen:2022-01-20 08:11:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 1536:O7PvzvDyfSNbzhU47FEdSGVS9ZID9khfC3+bLrubaDuPyVAB3Zfcpn+1MVoyJPkh:O7PvzWuXFEdSAeSD9jIBDuP/5GfqPmG
Threatray 13'834 similar samples on MalwareBazaar
TLSH T10F84FDF9E7E35293F8315A36CB91433461327EC9A4E45DF645C8BA2C4E302DE921E96C
File icon (PE):PE icon
dhash icon 31f0c0b2b2c0f071 (8 x Formbook, 7 x AgentTesla, 4 x AsyncRAT)
Reporter abuse_ch
Tags:AgentTesla DHL exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/220965/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe obfuscated overlay packed
Link:
https://www.filescan.io/uploads/61e9195a0f8c757253cfb9e3/reports/15f7be28-be84-4e88-a245-a09564e87d84/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/0fb0a35a-17f5-453b-9223-5fc0714cb69b
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/924511
Signature
.NET source code contains potential unpacker
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4860fe0ef130905e083db85110fbe732cb74933dba0567d5b3aa509579f796a0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-01-20 08:12:11 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
12
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jbqp4dxrgcif4cb5xbirb67hglfxjez5xicwpvntvjijk6pxs2qa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
06b04e6a349914e395b248b9c4d9cfaf028909c0871e3e78f8b6367f36f9eafd
AgentTesla
113eabe35a49134e8f6b1ba27c748826ea959de70fda113a6e71f70b6740b2d0
AgentTesla
180a5d8c28bc4b365d42351b37869f1ab329a6e9c3c442aea122080c9e932dda
AgentTesla
50736cc8fc65dbf67240893411344cc6ad8e318f73f5ec85125cb9987afd2b07
AgentTesla
708833adb2ee812262f329d04431f369c1e5046aa5030362c521c828af756ec2
AgentTesla
b85e4c358cd20b0ad6e0bcdb93e578ee2dc2a898cfa60da1f39be1ea8424ce92
AgentTesla
c771be7912e20d4522cdcfed63feac0e59a91dc053ff96faf862be6a8f8dfa1b
AgentTesla
cac3ab8433e775a539ed661fb2d9caf7799213007b9f8bc01080557c452ccc41
AgentTesla
f7bd786df639edd7ef050889027c751d321fc3bcf7670478da66a56cd6944c69
AgentTesla
f9af6e0e93f066a5788d1c5d0014204ff29c0080727647857e8f604885e552d8
AgentTesla
+ 13'824 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220120-j3vw5ahaa2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
4860fe0ef130905e083db85110fbe732cb74933dba0567d5b3aa509579f796a0
MD5 hash:
d721b75d85917803a6fca2c336175ddf
SHA1 hash:
83494f6e7e8810d426d638d5985c2910cda69e9c
Link:
https://www.unpac.me/results/0752f32d-2281-4776-bb53-b0b6fdfd0438/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4860fe0ef130905e083db85110fbe732cb74933dba0567d5b3aa509579f796a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_65628c146ace93037fc58659f14bd35f
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 4860fe0ef130905e083db85110fbe732cb74933dba0567d5b3aa509579f796a0

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/220965/

Comments