MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 574febaebd2d121ff74f363e268e4bf652841e284e1db03960d1f26338ea0eea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 574febaebd2d121ff74f363e268e4bf652841e284e1db03960d1f26338ea0eea
SHA3-384 hash: 061039f2bfecd7d41d57245350ab7fc7383c8aa3494c549ab28471483c5edaee559c0a2ee4062dfc3c24519a19969021
SHA1 hash: cb642f5bd20eb7a47b73d52399993a393e078bd3
MD5 hash: 00ec105e5693996ddeacc232ae4fe0b8
humanhash: saturn-orange-edward-black
File name:PO#017.pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:847'710 bytes
First seen:2023-06-30 07:01:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 91e96141ed5dbe3bc541c8aad7ff3c38 (22 x CryptOne, 7 x njrat, 5 x DCRat)
ssdeep 12288:4jOtvHMm5x6kqP8JUXnoswX0/Lh+OOd0Dz7RQsUa7sMQHjGV5:UOtT5xNcxXnYE9vOQpHUa7aKV5
TLSH T12B050221BAC184B1E4B729350EF1B371BB3DBD700B358ECB9B840A2D9B705D19935B66
TrID 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.6% (.EXE) Win64 Executable (generic) (10523/12/4)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon f2ceaeaeb2968eaa (68 x RedLineStealer, 21 x AgentTesla, 18 x AveMariaRAT)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
279
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO#017.pdf.exe
Verdict:
No threats detected
Analysis date:
2023-06-30 07:09:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e156c69d-bfb2-4711-a4e1-8e8a6e5bd687

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/403938/
Detection(s):
SecuriteInfo.com.FileRepMalware.15073.18139.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Launching a service
Creating a process from a recently created file
Modifying a system executable file
Unauthorized injection to a recently created process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/94206/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto greyware lolbin masquerade overlay packed replace setupapi shdocvw shell32
Link:
https://www.filescan.io/uploads/649e7dec1a035eeff9b38ac8/reports/30004829-6aa2-4eac-a3ae-f2512ac7b249/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/574febaebd2d121ff74f363e268e4bf652841e284e1db03960d1f26338ea0eea
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ec6e3db4-9de4-41a2-8b61-9a8e9b3176ce
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1263667
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Antivirus detection for dropped file
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 896697 Sample: PO#017.pdf.exe Startdate: 30/06/2023 Architecture: WINDOWS Score: 100 44 Snort IDS alert for network traffic 2->44 46 Found malware configuration 2->46 48 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->48 50 9 other signatures 2->50 7 PO#017.pdf.exe 10 2->7         started        10 SzvWIzD.exe 3 2->10         started        13 SzvWIzD.exe 2->13         started        process3 file4 28 C:\Users\user\AppData\Local\Temp\...\PO.exe, PE32 7->28 dropped 15 PO.exe 3 7->15         started        60 Antivirus detection for dropped file 10->60 62 Multi AV Scanner detection for dropped file 10->62 64 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 10->64 68 2 other signatures 10->68 18 SzvWIzD.exe 14 7 10->18         started        66 Injects a PE file into a foreign processes 13->66 21 SzvWIzD.exe 13->21         started        signatures5 process6 dnsIp7 70 Antivirus detection for dropped file 15->70 72 Multi AV Scanner detection for dropped file 15->72 74 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->74 84 3 other signatures 15->84 23 PO.exe 17 9 15->23         started        32 api4.ipify.org 18->32 34 api.telegram.org 18->34 36 api.ipify.org 18->36 76 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->76 78 Tries to steal Mail credentials (via file / registry access) 18->78 80 Tries to harvest and steal browser information (history, passwords, etc) 18->80 82 Installs a global keyboard hook 18->82 signatures8 process9 dnsIp10 38 api4.ipify.org 104.237.62.211, 443, 49694, 49700 WEBNXUS United States 23->38 40 api.telegram.org 149.154.167.220, 443, 49695, 49696 TELEGRAMRU United Kingdom 23->40 42 api.ipify.org 23->42 30 C:\Users\user\AppData\Roaming\...\SzvWIzD.exe, PE32 23->30 dropped 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 23->52 54 Tries to steal Mail credentials (via file / registry access) 23->54 56 Hides that the sample has been downloaded from the Internet (zone.identifier) 23->56 58 Installs a global keyboard hook 23->58 file11 signatures12
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/574febaebd2d121ff74f363e268e4bf652841e284e1db03960d1f26338ea0eea/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-06-28 16:54:02 UTC
File Type:
PE (Exe)
Extracted files:
29
AV detection:
20 of 24 (83.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k5h6xlv5fujb752pgy7cndsl6zjiihrijyo3aola2hzggohkb3va._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230630-htsvqsgd36/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot6189714391:AAFjToOdqxqti463Jxb44FuKRmVMyNjH1c8/
Unpacked files
SH256 hash:
5732cbf307b96dece46843921f2936cd87a2541b62f095dbf4ab17a8354f7410
MD5 hash:
6d5d44f5ce57e115c4e33f4d8905afb3
SHA1 hash:
f5d6e0ee74e21c18e7632af99f01dc304a4b32cf
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
Parent samples :
574febaebd2d121ff74f363e268e4bf652841e284e1db03960d1f26338ea0eea
5732cbf307b96dece46843921f2936cd87a2541b62f095dbf4ab17a8354f7410
SH256 hash:
785a9625fc06b11816a9d0e42523ada4509f2b63a2aae6306296889a24a99c53
MD5 hash:
65c01fca8afa7466940925f2058e433b
SHA1 hash:
e3e1d6dcbc820c019eb76f93053e17ac21dc26b6
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
SH256 hash:
79c22f052fddb2db145aee349f2f6055641926fde2bf91e5399302f447f21228
MD5 hash:
07b3d3ee47b8f78d8ce3f87c78c7bdef
SHA1 hash:
4735b25ccfaa4e28c8281aa7ffceb96d88d44b92
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
SH256 hash:
5732cbf307b96dece46843921f2936cd87a2541b62f095dbf4ab17a8354f7410
MD5 hash:
6d5d44f5ce57e115c4e33f4d8905afb3
SHA1 hash:
f5d6e0ee74e21c18e7632af99f01dc304a4b32cf
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
Parent samples :
574febaebd2d121ff74f363e268e4bf652841e284e1db03960d1f26338ea0eea
5732cbf307b96dece46843921f2936cd87a2541b62f095dbf4ab17a8354f7410
SH256 hash:
785a9625fc06b11816a9d0e42523ada4509f2b63a2aae6306296889a24a99c53
MD5 hash:
65c01fca8afa7466940925f2058e433b
SHA1 hash:
e3e1d6dcbc820c019eb76f93053e17ac21dc26b6
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
SH256 hash:
79c22f052fddb2db145aee349f2f6055641926fde2bf91e5399302f447f21228
MD5 hash:
07b3d3ee47b8f78d8ce3f87c78c7bdef
SHA1 hash:
4735b25ccfaa4e28c8281aa7ffceb96d88d44b92
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
SH256 hash:
5732cbf307b96dece46843921f2936cd87a2541b62f095dbf4ab17a8354f7410
MD5 hash:
6d5d44f5ce57e115c4e33f4d8905afb3
SHA1 hash:
f5d6e0ee74e21c18e7632af99f01dc304a4b32cf
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
Parent samples :
574febaebd2d121ff74f363e268e4bf652841e284e1db03960d1f26338ea0eea
5732cbf307b96dece46843921f2936cd87a2541b62f095dbf4ab17a8354f7410
SH256 hash:
785a9625fc06b11816a9d0e42523ada4509f2b63a2aae6306296889a24a99c53
MD5 hash:
65c01fca8afa7466940925f2058e433b
SHA1 hash:
e3e1d6dcbc820c019eb76f93053e17ac21dc26b6
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
SH256 hash:
5732cbf307b96dece46843921f2936cd87a2541b62f095dbf4ab17a8354f7410
MD5 hash:
6d5d44f5ce57e115c4e33f4d8905afb3
SHA1 hash:
f5d6e0ee74e21c18e7632af99f01dc304a4b32cf
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
Parent samples :
574febaebd2d121ff74f363e268e4bf652841e284e1db03960d1f26338ea0eea
5732cbf307b96dece46843921f2936cd87a2541b62f095dbf4ab17a8354f7410
SH256 hash:
79c22f052fddb2db145aee349f2f6055641926fde2bf91e5399302f447f21228
MD5 hash:
07b3d3ee47b8f78d8ce3f87c78c7bdef
SHA1 hash:
4735b25ccfaa4e28c8281aa7ffceb96d88d44b92
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
SH256 hash:
785a9625fc06b11816a9d0e42523ada4509f2b63a2aae6306296889a24a99c53
MD5 hash:
65c01fca8afa7466940925f2058e433b
SHA1 hash:
e3e1d6dcbc820c019eb76f93053e17ac21dc26b6
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
SH256 hash:
79c22f052fddb2db145aee349f2f6055641926fde2bf91e5399302f447f21228
MD5 hash:
07b3d3ee47b8f78d8ce3f87c78c7bdef
SHA1 hash:
4735b25ccfaa4e28c8281aa7ffceb96d88d44b92
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
SH256 hash:
574febaebd2d121ff74f363e268e4bf652841e284e1db03960d1f26338ea0eea
MD5 hash:
00ec105e5693996ddeacc232ae4fe0b8
SHA1 hash:
cb642f5bd20eb7a47b73d52399993a393e078bd3
Link:
https://www.unpac.me/results/2d7c9aae-c96d-4dda-8d34-ad308c7342a4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/574febaebd2d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 574febaebd2d121ff74f363e268e4bf652841e284e1db03960d1f26338ea0eea

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/403938/

Comments