MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c20baaa49d158f53ab58c31f8d875fd4043b7d3eef9d4f18c986ec334002e9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c20baaa49d158f53ab58c31f8d875fd4043b7d3eef9d4f18c986ec334002e9a
SHA3-384 hash: 86514920fc4215e67ae3fb16827a71297ddf686754eca8c4a2b8fcf636167220e54bd8f041e270fe3a43c8f9eb7acbbe
SHA1 hash: f440a2b3d6fc2e73edcb28f75e9ebb7d50104373
MD5 hash: 5bdad991decf39d6212c22eb23e88208
humanhash: floor-nevada-golf-echo
File name:PAYMENT SLIP.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:530'944 bytes
First seen:2023-03-17 18:37:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:MNd66m+LwfbaVYx9kyOkH5YWpX00XpYCluMAv3npMovInUg6dqrlb:CzLwzaqx7HYEhNhb
Threatray 1'200 similar samples on MalwareBazaar
TLSH T1F8B41245B560C72FDA9C76FAC0A5970053E86FB03432D21A6E397AD28A37743CD1C66E
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter cocaman
Tags:AgentTesla exe Shipping

Intelligence

File Origin
# of uploads :
1
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PAYMENT SLIP.exe
Verdict:
Malicious activity
Analysis date:
2023-03-17 18:39:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/92b90ea3-b79c-4769-8a89-348362042cba

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/375200/
Detection(s):
Sanesecurity.Rogue.0hr.20230317-1532.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cerbu packed
Link:
https://www.filescan.io/uploads/6414b38d3b01ade53e6f028c/reports/5f318023-7ab6-4a6e-8958-5e32b8c405bc/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4c20baaa49d158f53ab58c31f8d875fd4043b7d3eef9d4f18c986ec334002e9a
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a5ba9c6b-872d-4480-9b41-815fc3732795
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1196158
Signature
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4c20baaa49d158f53ab58c31f8d875fd4043b7d3eef9d4f18c986ec334002e9a/
Threat name:
Win64.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-03-17 13:26:56 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
6
AV detection:
18 of 39 (46.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jqqlvksj2fmpkovvrqy7rwdv7vaehn6t5345j4mmtbxmgnaaf2na._file
Verdict:
malicious
Similar samples:
0dfc6c7df7c32bb5212def47800d68f6f3168f284489fffb02b723da2d284c39
AgentTesla
13e85a56084b5afcf6030fbaee89e2c49b5616eb8f7f5da934f11547b2df2d10
AgentTesla
3b185f9e2349e436272277d50a22df609a8253d0fafb2c53ea003083b2196689
AgentTesla
577a6f8ac673a1b176fd32c9b8fe01178fee10a2602e3ccbc02b3fdebfa9bf0b
AgentTesla
67388fca813133367167001c4114d6cd97b4bed24d0acdfda8b5784723a698ea
AgentTesla
88d0963292143c5ba31261b14fa12f59edcd78df1bea35281e8cf080aa1460c0
AgentTesla
91ac5e95c271f56efcf7f8c2f1ce27579242a2cdca317fd11bf7ff380c9750ed
AgentTesla
bc9a80c327839012274d763d66186497685a6b73e0b20eea73c720d61f5c9407
AgentTesla
bcba671f1e3e1f7ab80f59d5c1cb280bfec3ca519b37820af0bb720fb5d7a8b9
AgentTesla
d46b71aebfacfb2ca951e24d2fd60487c2ef99958909fb8aabefc4c1172b8f7c
AgentTesla
+ 1'190 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230317-w92dpsbe7t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Uses the VBS compiler for execution
AgentTesla
Unpacked files
SH256 hash:
4c20baaa49d158f53ab58c31f8d875fd4043b7d3eef9d4f18c986ec334002e9a
MD5 hash:
5bdad991decf39d6212c22eb23e88208
SHA1 hash:
f440a2b3d6fc2e73edcb28f75e9ebb7d50104373
Link:
https://www.unpac.me/results/ca0a7f43-9e0c-46ed-a04b-e9537b48f57a/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4c20baaa49d1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/4c20baaa49d158f53ab58c31f8d875fd4043b7d3eef9d4f18c986ec334002e9a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3fdc18fb3e0fc005fc2dd74e912389748d805653cb8a0d978779390e75ca4a02

AgentTesla

Executable exe 4c20baaa49d158f53ab58c31f8d875fd4043b7d3eef9d4f18c986ec334002e9a

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 3fdc18fb3e0fc005fc2dd74e912389748d805653cb8a0d978779390e75ca4a02
Cape
Cape
https://www.capesandbox.com/analysis/375200/
  
Dropped by
MD5 9f82c1885282264acacff8844494c930

Comments