MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4f7ee7b035490423edd7b7c641b2ac81c192252de8c5ab2e40375274a170d5fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 13
| SHA256 hash: | 4f7ee7b035490423edd7b7c641b2ac81c192252de8c5ab2e40375274a170d5fc |
|---|---|
| SHA3-384 hash: | 1c977ef7e32264c2a156c86ebb227df4f34c59df69ea03fe32720d9488dedb6e9353b1153bfe4136d65790490668dca0 |
| SHA1 hash: | c10e0792a7a9e5618fc1f2bad28eeadc3ce25db8 |
| MD5 hash: | b1dca66504e5479a77d8c5e8ee58afde |
| humanhash: | eleven-muppet-whiskey-oven |
| File name: | DHL Shipping Documents and Notification details.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 653'824 bytes |
| First seen: | 2023-10-17 10:48:35 UTC |
| Last seen: | 2023-10-17 11:48:45 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 12288:6BLXmsrJM1iagDkWknUsProAKvxuQYfwfqMbv8oO+M9wsD+Ayr:KLWiM4aWryPM5AQ4niPiND+Ay |
| Threatray | 156 similar samples on MalwareBazaar |
| TLSH | T19DD42315B7FD971BF977A7FA849210001BBDF287A89BDBC90FC630CD0516B4146A4A2B |
| TrID | 61.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.1% (.SCR) Windows screen saver (13097/50/3) 8.9% (.EXE) Win64 Executable (generic) (10523/12/4) 5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  abuse_ch |
| Tags: | AgentTesla DHL exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
306
Origin country :
NLVendor Threat Intelligence
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
masquerade packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Status:
Malicious
First seen:
2023-10-17 10:49:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
18 of 23 (78.26%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
agenttesla
Similar samples:
+ 146 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
spyware stealer
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
c941a534f960bd544c61d9f3c13ac12a678de6698871d254bf0110ccb8efe259
MD5 hash:
5121ce19f29de71067d1083d7073eb7e
SHA1 hash:
1a3701d6e38c21ea741b417fbf8410c4a0fc6437
SH256 hash:
14bb209b285279dab6ec2ec5b36dca3286fde25f887c5b7c2d250296ea1294ba
MD5 hash:
b0172cb5587e2323940dd50f7b8e160f
SHA1 hash:
630f9a2f75385c31819c26b625720ed0b07f2226
SH256 hash:
b1270dc9ec3f22c6fd2296239426ac7c48589589580d4a1b3da8188920b22a63
MD5 hash:
5c904da8528cfb1b87b15a6aa7c059cd
SHA1 hash:
f0a192969485d1bc34bf52adf37d9c20176d6b85
SH256 hash:
9d9d68e0422042d4a8a4567b201fc4bf6d3f2d9423b04947b5e53a1b6c52283a
MD5 hash:
a3496c6cf30d06c38c8ddc3a96f0e786
SHA1 hash:
ac8165e5be128a39586bbcab754261601f494dbf
SH256 hash:
068b103533bd50fd32cb8df489bc3a04193174cb4ea556a1ffe852d3cbac112d
MD5 hash:
bce58d976229b466b5b84dd6ae51ffd4
SHA1 hash:
7c4c7d969a7bbdc74447c434dd5d862138e1b260
SH256 hash:
4f7ee7b035490423edd7b7c641b2ac81c192252de8c5ab2e40375274a170d5fc
MD5 hash:
b1dca66504e5479a77d8c5e8ee58afde
SHA1 hash:
c10e0792a7a9e5618fc1f2bad28eeadc3ce25db8
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DebuggerCheck__GlobalFlags |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Active |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Thread |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | maldoc_find_kernel32_base_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | maldoc_getEIP_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Author: | qux |
| Description: | Detects exe does not have import table |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.