MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60cb144c7f4433013b373b1ca8704cee48c8f1e8417a4ca520e2386e4d3ea8cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60cb144c7f4433013b373b1ca8704cee48c8f1e8417a4ca520e2386e4d3ea8cd
SHA3-384 hash: 0bd7fed2bfb1626fe238e9e803b3f4332531f670691a916b1617e30bee885ed9f3f32b3773eb0af485bc366fe1d085c2
SHA1 hash: bb65498ca3a838a2755e9ab93047656688749b63
MD5 hash: 518261f6bedf83ce87814867922a7cf1
humanhash: wyoming-fruit-football-mango
File name:Nr.21784795 Technische Dokumentation.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:468'864 bytes
First seen:2023-06-13 10:15:22 UTC
Last seen:2023-06-13 10:45:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep 6144:jQLFhJEW1XX8fKDq38j5T+FtWnfR7cs7N4k4rSx9KNHUEY7yzxRKtm0NOrqEhugz:0FzEaX8f+qsytMcs7atA9CA28PF5o
Threatray 966 similar samples on MalwareBazaar
TLSH T170A401263424C5B3D911A1F3AC6981829BB87D201A9C8F57367E775D1C3A29FFC1A36C
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 7169696979796961 (1 x GuLoader, 1 x AgentTesla)
Reporter abuse_ch
Tags:AgentTesla DEU exe geo signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2023-01-16T08:35:15Z
Valid to:2026-01-15T08:35:15Z
Serial number: 6d66dfc1c88fa3aeb52d7ab13f2a4eaac5abc881
Thumbprint Algorithm:SHA256
Thumbprint: e27e1821487b110bafef3f8cfe454ced70480b80afc9e0149f599c78f26ac30f
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
275
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Nr.21784795 Technische Dokumentation.exe
Verdict:
Malicious activity
Analysis date:
2023-06-13 10:20:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b86ff68f-521f-4db0-9cbb-da9a88995e3b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/398208/
Detection(s):
SecuriteInfo.com.Trojan.Win32.GuLoader.RV.MTB.14418.10295.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a window
Creating a file in the %AppData% subdirectories
Creating a file
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
buer lolbin overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/648841e49f45f940f553c23f/reports/59f22e4a-cca2-45b8-9cc4-41b463ce9ccd/overview
Verdict:
Malicious
Labled as:
TR/Redcap.lwsul
Link:
https://www.hybrid-analysis.com/sample/60cb144c7f4433013b373b1ca8704cee48c8f1e8417a4ca520e2386e4d3ea8cd
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/7156d4b5-3e86-4b4d-a96a-7335a10ab959
Result
Threat name:
GuLoader, AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1253568
Signature
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60cb144c7f4433013b373b1ca8704cee48c8f1e8417a4ca520e2386e4d3ea8cd/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2023-06-12 12:23:33 UTC
File Type:
PE (Exe)
Extracted files:
76
AV detection:
10 of 37 (27.03%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mdfritd7iqzqcozxhmokq4cm5zemr4piif5ezjja4i4g4tj6vdgq._file
Verdict:
unknown
Similar samples:
14ae647473cbf4def9becdbbb1f007fd8c96c63be5c88014415ab13e6467168f
AgentTesla
151fb5746b08b95408b92e08f4bbeac8c4a1a3fc3ad6f43d237357f10476b33f
AgentTesla
68ecb3a0784bbfd4ac9f3d1c76cfc09cff02b4298839e2e1b293e9ef8833b265
AgentTesla
79e1fc85396ae65e8431f8ceb92fefb5ec396381840d830c415ea2d81cb78a49
AgentTesla
959fc8883e6b1d4ab77f9738792435e2dae1969530f36d2672db6cb397778687
AgentTesla
96c459f3f71ca66620515448f8dfa12c67d8b3e020776c93ccda641cce782ad6
AgentTesla
9c3860c6744d8b2718e1109e327795014997a81b0e21706a96242d0f8d52f55b
AgentTesla
a1662b8e9f60ae12d014dc7bf567d136abef56c45d76b65c765c71d411c7ee8f
AgentTesla
d0294bc11b1c8e0655189aba2ade4ffb54da6f36e2afc2ef2e0045a5a17203bf
AgentTesla
ef66ea0bcee19ccd3d2771a170ff218a3e43b27f1b18f24e08685cb4d3fe053a
AgentTesla
+ 956 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230613-massvafg35/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks QEMU agent file
Loads dropped DLL
AgentTesla
Unpacked files
SH256 hash:
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 hash:
0063d48afe5a0cdc02833145667b6641
SHA1 hash:
e7eb614805d183ecb1127c62decb1a6be1b4f7a8
Link:
https://www.unpac.me/results/af49048f-7184-47f7-882f-127eca281498/
Parent samples :
5312214b15330113f6eab71565e1e3c7d1ee3b59daa6703c271aaf3b192e6809
02fca6ef5d9d8b1eb29f7ac8ea0573b504ea7f06c215e091791653b40fe1329a
cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427
045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee
f2a883a0e4b01c72b0f063df3be5a0102e5c8fbaedc39c8d35c632b200599283
dffefbde27442b9095388b1871ffdc101c430b9a814138be4f962328a5b73fde
e0fb60da371912c158861c9660632d58e45cfcff12351cc9e03f497f319eb5de
904f69a4bed3844273cce1676e8920794815af4c1527e560bbc1bc44b5b8457a
SH256 hash:
223d24baa5f47814cd176aeef5dae0f8cbd974907fbe620a77bc59154a5244fb
MD5 hash:
42a17d83790648ea14596ea743f6fcf0
SHA1 hash:
bbd6efdf9ccd8ddccd86b78379100be162c5d4e6
Link:
https://www.unpac.me/results/af49048f-7184-47f7-882f-127eca281498/
SH256 hash:
60cb144c7f4433013b373b1ca8704cee48c8f1e8417a4ca520e2386e4d3ea8cd
MD5 hash:
518261f6bedf83ce87814867922a7cf1
SHA1 hash:
bb65498ca3a838a2755e9ab93047656688749b63
Link:
https://www.unpac.me/results/af49048f-7184-47f7-882f-127eca281498/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/60cb144c7f44/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/60cb144c7f4433013b373b1ca8704cee48c8f1e8417a4ca520e2386e4d3ea8cd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/398208/

Comments