MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f04a42a32afc88988279c6bd13c58623b9d8989d11119be3f1e3a35fe4d7fa0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f04a42a32afc88988279c6bd13c58623b9d8989d11119be3f1e3a35fe4d7fa0
SHA3-384 hash: ca8c397e95c672d7af3a1922448e3ac49143a2e5eecde03f9043724eac42d095e3f74f64c9a94d9f12dfb05c04621bc7
SHA1 hash: 857bd1614f537f6d9b0adb99f2fb7e733c19f6d0
MD5 hash: c290bcfc39aa5061937f8a7caf5ea4fd
humanhash: bluebird-mobile-september-fanta
File name:FedEx_AWB#5035329204643.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:819'712 bytes
First seen:2023-08-08 06:17:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 24576:6cHiBfXOMv9lCWcVtnkta+shKqNl7iQ1:6cHiBxlFcV6a+sXl7iq
Threatray 5'568 similar samples on MalwareBazaar
TLSH T105050201377D9F36E4F593F9253920601BB1346E29ABE6680DE2B0CF1976F109A11F6B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
271
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
FedEx_AWB#5035329204643.exe
Verdict:
Malicious activity
Analysis date:
2023-08-08 06:20:01 UTC
Tags:
stealer agenttesla
Link:
https://app.any.run/tasks/b1d4f13c-cab8-40fc-a4cd-fca9f24cb862

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/441178/
Detection(s):
SecuriteInfo.com.Win32.RATX-gen.32430.20243.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/64d1de1bdaa9db50534043a1/reports/f6097750-64ee-485f-9c68-8f6317d70e1c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4f04a42a32afc88988279c6bd13c58623b9d8989d11119be3f1e3a35fe4d7fa0
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/8b14c4bc-8f6f-4efa-96b0-b29bdbf46f78
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1287428
Signature
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f04a42a32afc88988279c6bd13c58623b9d8989d11119be3f1e3a35fe4d7fa0/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-08-08 03:03:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j4ckikrsv7eitcbhtrv5cpcymi5z3cmj2eirtpr7dy5dl7snp6qa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0025fa6f194a33862ff4241a1fefed9477645cb36cb99e65d05b639b29dcdcdd
AgentTesla
1f896398b69e22be7442bfd778d704b1e3b0961a51a8307e175d0876f8b67055
AgentTesla
29f2cb40f49d921306012930991a3e95de4257ff280f91ece81a5eb6f29d4025
AgentTesla
372293f19446ed57ca833445d5d1efd66a6e4fc56ce5fd3164de5077845f2e87
AgentTesla
793e60744aa163e0da636233df2fc83f43d447cddf4a89b28ff15a0ca95e69f9
AgentTesla
94e6c208de07ad120514c880fdef5a4a6b938701107c995667dc0a6d6fd9ab97
AgentTesla
ee2da73179620f58484c7ce7052675cdd0e12d05ba43d7d1d0cde21ef8260383
AgentTesla
f8b9d5747aecadccc915a840b8eeb87080b852a3fe7f3382f3a0389162a4162f
AgentTesla
+ 5'558 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230808-g2lwqace2t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
504410fd6158a7346f5a2e7b7714203b329d46dab5d129719410d5c325122804
MD5 hash:
74ed681a2d7aed1dae5627d4367474f8
SHA1 hash:
cad2df636d3f0710f69fdb18cbae03a332341dd3
Link:
https://www.unpac.me/results/bb8a0057-e8b7-4fd7-abc1-fda11212a41a/
SH256 hash:
0a6bd230f852b0ea44610bf025b8a6388b50281a53c605782f02db246ab8423b
MD5 hash:
9f1bce530f26ae3644830b6ee8a58c07
SHA1 hash:
acafe183f3b5af3e5eba3c1160fae890e2b2a979
Link:
https://www.unpac.me/results/bb8a0057-e8b7-4fd7-abc1-fda11212a41a/
SH256 hash:
03b37ba9c789bbd01c8964ac1fcc8362a0b0dc33355edc642ba2b78a41c5d090
MD5 hash:
0ffe9739e2ead3c76115ca9009f6e08e
SHA1 hash:
9f92a875c7b1e6e80ecff79a026d1d73e29bf7e7
Link:
https://www.unpac.me/results/bb8a0057-e8b7-4fd7-abc1-fda11212a41a/
SH256 hash:
34cffb752ed7c3c21668ae30c2d24159ce479b26600a0506430b3a02bf814a52
MD5 hash:
fff6ce705fc848c0e4c2dd1eb07442a0
SHA1 hash:
7884b8a7e5425ea041f827db3dadaf05fa0b786b
Link:
https://www.unpac.me/results/bb8a0057-e8b7-4fd7-abc1-fda11212a41a/
SH256 hash:
4f04a42a32afc88988279c6bd13c58623b9d8989d11119be3f1e3a35fe4d7fa0
MD5 hash:
c290bcfc39aa5061937f8a7caf5ea4fd
SHA1 hash:
857bd1614f537f6d9b0adb99f2fb7e733c19f6d0
Link:
https://www.unpac.me/results/bb8a0057-e8b7-4fd7-abc1-fda11212a41a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4f04a42a32af/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4f04a42a32afc88988279c6bd13c58623b9d8989d11119be3f1e3a35fe4d7fa0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 4f04a42a32afc88988279c6bd13c58623b9d8989d11119be3f1e3a35fe4d7fa0

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/441178/

Comments