MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4cde76ab5dbcd056a0dc49649e7bce6e890f58cd6ba476a0b5f7a4a92d8f685d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4cde76ab5dbcd056a0dc49649e7bce6e890f58cd6ba476a0b5f7a4a92d8f685d
SHA3-384 hash:	fe9591abb0e1e3fb192b5ede160e666ed9fb7a4c42793c98cb126966e2513e66855529bad3b761d0043e4814aadd5c6c
SHA1 hash:	0ace129d64a889e472889212948ba6ba7bb461d1
MD5 hash:	5deed9445274491ca7ead38201c693eb
humanhash:	cola-berlin-artist-table
File name:	Remittance Advice – Invoice 3429566_PDF.exe
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	654'848 bytes
First seen:	2023-12-22 06:55:14 UTC
Last seen:	2023-12-22 14:12:41 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:yKumomWOHSVtb1yVFyCbQ3yFBz7hl7sXTgRoYgEQAMgWtNzj:+b/BVtbeF1TrPhtoURoYgjAlQ3
TLSH	T136D41254B3789183ECBE42FF802266259B7DB01BA611D7EB0CC621970EF5B50CA91B5F
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	0060796969697000 (8 x AgentTesla, 6 x Formbook)
Reporter	abuse_ch
Tags:	AgentTesla exe

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

264

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Porcupine.Malware.58887.UNOFFICIAL

Alert

Create hunting rule

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/4cde76ab5dbcd056a0dc49649e7bce6e890f58cd6ba476a0b5f7a4a92d8f685d

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Agent Tesla

Malware family:

Agent Tesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0a2176da-7a7f-4b8e-806e-ed8ecf25ac34

Joe Sandbox AgentTesla

Result

Threat name:

AgentTesla

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1365998

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Antivirus / Scanner detection for submitted sample

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/4cde76ab5dbcd056a0dc49649e7bce6e890f58cd6ba476a0b5f7a4a92d8f685d

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/4cde76ab5dbcd056a0dc49649e7bce6e890f58cd6ba476a0b5f7a4a92d8f685d/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-22 03:08:39 UTC

File Type:

PE (.Net Exe)

Extracted files:

6

AV detection:

15 of 23 (65.22%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jtphnk25xtifnig4jfsj466on2eq6wgnnoshnifv66skslmpnboq._file

Threatray agenttesla_v4 agenttesla

Verdict:

malicious

Label(s):

agenttesla_v4

Alert

Create hunting rule

agenttesla

Alert

Create hunting rule

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231222-hqcdksdbf5/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

UnpacMe

Unpacked files

SH256 hash:

4cde76ab5dbcd056a0dc49649e7bce6e890f58cd6ba476a0b5f7a4a92d8f685d

MD5 hash:

5deed9445274491ca7ead38201c693eb

SHA1 hash:

0ace129d64a889e472889212948ba6ba7bb461d1

Link:

https://www.unpac.me/results/f96c7f3d-d843-46b4-aff7-23e02c4f575d/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.87

Link:

https://yomi.yoroi.company/submissions/4cde76ab5dbcd056a0dc49649e7bce6e890f58cd6ba476a0b5f7a4a92d8f685d