MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51f24503d32c9e10a2e7afe027d438380d007cd1566e5399cc52b039cacdb2ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51f24503d32c9e10a2e7afe027d438380d007cd1566e5399cc52b039cacdb2ea
SHA3-384 hash: 310391790bcd8749b66019f896bc578f55edb81024d67692a8c1258a4a5d5f6c644a61580f928066dd6a7f2c385c198e
SHA1 hash: be932a6f544bb7126b5240c9733d0fa0db87148b
MD5 hash: e508efd0a94987b67e8c1b9ee25be34f
humanhash: mountain-wolfram-gee-fix
File name:Notificación Transferencia Interbancaria.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'315'840 bytes
First seen:2024-01-11 16:21:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 948cc502fe9226992dce9417f952fce3 (1'182 x CredentialFlusher, 446 x Formbook, 231 x AgentTesla)
ssdeep 24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8asIhF8m3STb:LTvC/MTQYxsWR7asIvR3S
TLSH T17D558D023387D07AFE9A92370BD6ED8156B96D150423A63F125839F9FE7F1A1053E263
TrID 68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.5% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.4% (.EXE) OS/2 Executable (generic) (2029/13)
dhash icon 71d0f8f4f4f8f071 (2 x AgentTesla)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
348
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Win.Malware.Recam-6989937-0
Create hunting rule

SecuriteInfo.com.Trojan.Generic.33203615.28472.17882.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Launching a process
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Reading critical registry keys
Sending a custom TCP request
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/51f24503d32c9e10a2e7afe027d438380d007cd1566e5399cc52b039cacdb2ea
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ec11587c-e2e7-4713-af3d-5881f6622daf
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1373213
Signature
Antivirus / Scanner detection for submitted sample
Binary is likely a compiled AutoIt script file
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Found API chain indicative of sandbox detection
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/51f24503d32c9e10a2e7afe027d438380d007cd1566e5399cc52b039cacdb2ea
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51f24503d32c9e10a2e7afe027d438380d007cd1566e5399cc52b039cacdb2ea/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2024-01-11 16:22:05 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
19 of 24 (79.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=khzeka6tfspbbixhv7qcpvbyhagqa7grkzxfhgomkkydtswnwlva._file
Verdict:
malicious
Label(s):
agenttesla_v4
Create hunting rule
agenttesla
Create hunting rule
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/240111-tt7vfabbfr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
AgentTesla
Unpacked files
SH256 hash:
213215574964beac6055f2cd9e7935b9394ce1aab54d0a723682700dbbac21fe
MD5 hash:
6001b9d313616cf68a9d9d6bc7492015
SHA1 hash:
6aec558ebca79b3a6a0b4aaf3c9daa18a1fe7cf5
Detections:
win_agent_tesla_g2
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/a37d9453-569f-4a64-bb2b-7fe143beefda/
Parent samples :
c9be1ff9d80d934774556669459ad3242500a745531ba25f7c874f32f318cdd1
f08afadff8298941a488a237df4deb8f94f13bf274411548f386d2828f4df636
51f24503d32c9e10a2e7afe027d438380d007cd1566e5399cc52b039cacdb2ea
bc3e963b1e6f8e375e6814f653eeb463d2bf8e47b867cf16ca9964a5e0d43804
ce89a0a88051c50bf0be5ab41e5f2d478b5f3eac141b37a9743cab99423656ce
c8634453c065450c28be1e99497aea78c294693e0c05e63a6d6fb83cc621f190
71f5ee1f2818fe32525676a403776d620101dfe96ae3873a3e325016ff136002
48d245036c30302a860c3a616e29cb0e633fca178bb363d01007432d3c571713
64786f8c089130fa81ba1970f8bcdee574964bb7653f5aca740a38fc6eef74e2
aa64d8ae63a060c83638ad8a45e5a4e445a53845f4f22fe808f1828663629731
7f8bb8901ac2cd42c191b43dc859d256628e6419a418feed9bf44210b1e4c207
213215574964beac6055f2cd9e7935b9394ce1aab54d0a723682700dbbac21fe
e46caf67893b64806cdcea05d9b42e52fa65f239cc12782ab31766beac12eb37
2fdefe874a54576e8a4f4566b328120a7163a47b1000af443683af41698b6b2a
717b2beba07031c0671b2cb794d01b5f365c58ab156c0929a05d1cc0f3f4b17e
274013bc54c33bfd77473b8a92016b247b6832a1d26a9f412596cc9189775efe
2ddbd1c388f18a820122163f5c250dbfac936824267487cf0c81fb3b01185b4a
cdd388be236deee1d6613f35f895fa3adc65cd680e560faf0a174b0004c93995
967e07ed35fc477b00fe777c8bd4f5e7ead02d2581987bb75f6386a485799078
2b8f5dfdd98be0d5612f31c49ec4e3abdc14ab16091582f904949a1bdf476ab4
b96a282048c3221ce0180359da5cf97c55c7cfb054f7cfdde1bf5438fdb55399
d8190f8804e6bb5885f42a27307794ceae1fd1d4675b3c6a96d70c30324374bb
44cf26d4eda3a4366204a89842a433c77e44184db6bf2c00a3547288a73d4792
213255cb36f1a19a7d374ba37f98b553f2a10fa9f486e92ed2ca377d1a6dc6d7
4b76f920a96119a383e7c5df2992e9e7fe5e11ef45e1a630dbe8b3abc49abae7
3661575ad4a227bc52a9fcdb9a56ea19e0f882105300b938e9c0b634fe46d892
ebf39fb8c6da07c6f344537cb98113d3f6f34bac9097e2c195bb9073c790d1c5
14825e0e8ecc953c8ddf82dc0af6159ec59d97ea51472a3a025f0a7c2afef1ad
e7a1f2a77a5d8a28ca36421484bb560f334b4399ae93ebdba719486788edd854
4eae876a9c21fadb647a6fe14c83272189ace267ebed4b320c73da14e095dec7
34e8ac3bd8264bf5915c4bdbd7317bd369a1c60548f3bf18ddb12f0780593208
ff2be6f85c26c62d50364e48cc6f6209df35b82d6c4b0db31e776f84b81629a5
86c0e8c71fe53ff1ee1ac2a494c208392b9f4128f85552e69105e8fa19724f63
50eae2b11320442a2ac89762a8bac816626850ac2563312a9b421d692fdd8ac2
0eee8e3b1a6558f648e2519e494ea36b8e079bf6e0cbba55bfa9dcbfc99eac11
fc7c241bd2d7edf961b8f1af19fc80419d239c67d72a8eb0610152f1e67841d1
7c11ccc1701800c57b435767bc27bf966b88c66e0df0dd220d9f3e6bde634367
93a9b3b4455c1e8469d1e70599f1ba12d103dbf09d9bcaf079a00e0ca55aa72c
1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af
f8b68f9f0dc3d844e3ae080463b29bc9bb82a750b3ab01aed7fcab4cef1519a8
67bf2a6e18cc9f982fbafc235f75604ab53da2936365bb29dc008470ebfb7fd1
92c5d005c4454ff4be8093157b6f5d5cb11e7254fb3f979ffdddf167e464955f
78d2fb60645775efc2137c4f4dab8f737724f9936577f84fe3e3e01622e9770b
523c3e9f716ca9f2a75109f674135b55e9b25259d5d078175fb5580965426f8a
d2b275edfe93caf7e90362a513f00ffec34f1b10df49d950db008a3417045311
SH256 hash:
51f24503d32c9e10a2e7afe027d438380d007cd1566e5399cc52b039cacdb2ea
MD5 hash:
e508efd0a94987b67e8c1b9ee25be34f
SHA1 hash:
be932a6f544bb7126b5240c9733d0fa0db87148b
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/a37d9453-569f-4a64-bb2b-7fe143beefda/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/51f24503d32c9e10a2e7afe027d438380d007cd1566e5399cc52b039cacdb2ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV2
Create hunting rule
Author:ditekshen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Windows vault credential objects. Observed in infostealers
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:MALWARE_Win_AgentTeslaV2
Create hunting rule
Author:ditekSHen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 51f24503d32c9e10a2e7afe027d438380d007cd1566e5399cc52b039cacdb2ea

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments