MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 601dc4de31bcaa59570d7ec039396da0c846daa9fca986721617c2574d7c11f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 601dc4de31bcaa59570d7ec039396da0c846daa9fca986721617c2574d7c11f6
SHA3-384 hash: 0e012a8531f6d9c0e22784023168da4159f54663df478ade9a1b6a65839dc913ecfa776fba675663f390f5e2e940d476
SHA1 hash: 04f6f1876dc2ad221f05f0e9c9dd706551860988
MD5 hash: 41b402f4dd2d4499d2cf8a2c767011be
humanhash: bluebird-cold-helium-fanta
File name:nFra. 23-25.pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'412'533 bytes
First seen:2023-06-04 14:08:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 12e12319f1029ec4f8fcbed7e82df162 (388 x DCRat, 52 x RedLineStealer, 51 x Formbook)
ssdeep 24576:NTbBv5rUan8ztIMs1hgtrCxDKvMrBW4ey2Tygt90e+hoxktMpO:HBj8ztI0RCkvMr8Maygt+HYO
Threatray 570 similar samples on MalwareBazaar
TLSH T1EA652302BED694F2C4B21E3259756B22A97DBE201FA88DEF53D4092DDE314C0D7357A2
TrID 89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.5% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 74f4d4d4cce4e8e0 (27 x AgentTesla, 19 x Formbook, 17 x DBatLoader)
Reporter FXOLabs
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
300
Origin country :
BR BR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
nFra. 23-25.pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-06-04 14:09:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d0edb539-d7af-42d9-ae88-f548022e8782

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XorStringsNET
Create hunting rule
Link:
https://www.capesandbox.com/analysis/395550/
Detection(s):
Sanesecurity.Malware.29320.Rarsfx.SUD.UNOFFICIAL
Create hunting rule

Porcupine.Trojan.133884.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.GenericKD.38920448.13962.7593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Launching a process
Using the Windows Management Instrumentation requests
Reading critical registry keys
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Unauthorized injection to a recently created process
Stealing user critical data
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/89322/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm autoit greyware hacktool keylogger lolbin lolbin overlay packed packed setupapi.dll shdocvw.dll shell32.dll wscript
Link:
https://www.filescan.io/uploads/647c9aff758bee8d103fb478/reports/dae58559-ae2b-4c68-b7f4-14868ef66d5c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/601dc4de31bcaa59570d7ec039396da0c846daa9fca986721617c2574d7c11f6
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5a36885a-335e-43b5-aa9a-16993fc7bec4
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1248375
Signature
Antivirus detection for dropped file
Contains functionality to modify clipboard data
Drops PE files with a suspicious file extension
Found API chain indicative of sandbox detection
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Starts an encoded Visual Basic Script (VBE)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM autoit script
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 881395 Sample: nFra._23-25.pdf.exe Startdate: 04/06/2023 Architecture: WINDOWS Score: 100 54 Found malware configuration 2->54 56 Antivirus detection for dropped file 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 6 other signatures 2->60 14 nFra._23-25.pdf.exe 37 2->14         started        process3 file4 44 C:\asmd\cwhvst.pif, PE32 14->44 dropped 46 C:\asmd\DOG.exe, PE32 14->46 dropped 78 Drops PE files with a suspicious file extension 14->78 80 Starts an encoded Visual Basic Script (VBE) 14->80 18 DOG.exe 2 14->18         started        22 wscript.exe 1 14->22         started        signatures5 process6 dnsIp7 48 boyar.com.tr 94.199.200.38, 49692, 587 AEROTEK-ASTR Turkey 18->48 50 windowsupdatebg.s.llnwi.net 18->50 52 mail.boyar.com.tr 18->52 62 Antivirus detection for dropped file 18->62 64 Multi AV Scanner detection for dropped file 18->64 66 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->66 68 4 other signatures 18->68 24 cwhvst.pif 3 4 22->24         started        signatures8 process9 file10 42 C:\asmd\run.vbs, ASCII 24->42 dropped 70 Antivirus detection for dropped file 24->70 72 Multi AV Scanner detection for dropped file 24->72 74 Found API chain indicative of sandbox detection 24->74 76 Contains functionality to modify clipboard data 24->76 28 wscript.exe 1 24->28         started        signatures11 process12 process13 30 cwhvst.pif 1 28->30         started        process14 32 wscript.exe 30->32         started        process15 34 cwhvst.pif 32->34         started        process16 36 wscript.exe 34->36         started        process17 38 cwhvst.pif 36->38         started        process18 40 wscript.exe 38->40         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/601dc4de31bcaa59570d7ec039396da0c846daa9fca986721617c2574d7c11f6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-06-02 21:10:41 UTC
File Type:
PE (Exe)
Extracted files:
300
AV detection:
25 of 37 (67.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mao4jxrrxsvfsvynp3adsolnudeenwvj7suym4qwc7bfotl4ch3a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3504e40c6a3cfdd5fa084250cf488cf9d3fad763f3c327ad4d99cf08be328cff
AgentTesla
4ae67a52de5f2bcaea6c9158b4b2dfd3b2953885c34063547b736a4a1096fcb2
AgentTesla
594d61a4bcbcc6503743aae78c47f798557492ba9c0704c3aa188f528b50c5e3
AgentTesla
8fe933e8bf76350e1a991f00cb12b9071ba17f5586a001e17da49e6892ac34f5
AgentTesla
b3abbc4d6ecd9a9774e53fca4639b59cd5e24fde9bf97742b046ece663eb2e41
AgentTesla
d5edadd969395a3c5fd2a2cf9832684b11680480b5ca75b464988cff244a6d6d
AgentTesla
d6184367b93e40e22f209756274697796820542d46d80ef74d810b2b8785bedd
AgentTesla
dc6132f9c63cd966c76790f0761299f92c31684197e40a949c4e1eb9a539bfc8
AgentTesla
e15347eeeba6fb5f12440c9c2720d8055747cd973fde267d7e159f40efa62ab5
AgentTesla
+ 560 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230604-rf4vhscd53/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Accesses Microsoft Outlook profiles
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
80d075a45bff0f4bc744d3bdafcffff45c391dd743c99237471e92b369d540a3
MD5 hash:
c9b8676672fe5aab24da3c8c2cbb590b
SHA1 hash:
0f6afe2ce6611da390a75390a9402cf9cf2e8452
Link:
https://www.unpac.me/results/6b1841bc-cf0b-452b-95fa-c59077c0f38e/
SH256 hash:
38e2c440f317ea92db1ad85a902007dd05a957fe0f3a15bc039f4677f59ab2ad
MD5 hash:
5b797d41852b7a59f9259cab8d757f1e
SHA1 hash:
3f9e7ea7caed571f12537cda3243a6026b19f7b5
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/6b1841bc-cf0b-452b-95fa-c59077c0f38e/
SH256 hash:
601dc4de31bcaa59570d7ec039396da0c846daa9fca986721617c2574d7c11f6
MD5 hash:
41b402f4dd2d4499d2cf8a2c767011be
SHA1 hash:
04f6f1876dc2ad221f05f0e9c9dd706551860988
Link:
https://www.unpac.me/results/6b1841bc-cf0b-452b-95fa-c59077c0f38e/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/601dc4de31bc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/601dc4de31bcaa59570d7ec039396da0c846daa9fca986721617c2574d7c11f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 601dc4de31bcaa59570d7ec039396da0c846daa9fca986721617c2574d7c11f6

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/395550/

Comments