MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62534a146dc4b71bb4861d8924706ff594a92884257e540b6bd444e0b580f0f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 62534a146dc4b71bb4861d8924706ff594a92884257e540b6bd444e0b580f0f0
SHA3-384 hash: 75dcbcf20bc587d0d801f43b94fd6ea08f0644f52422465e8ccd84d6da1572d11a6d82df98f1610bfb0c3f3b1fe5462d
SHA1 hash: 80bcd55bcdd32ca2178b6f513950ac2a5594cf25
MD5 hash: adaa6e560706d818775dd346f31986e9
humanhash: jig-item-muppet-cup
File name:Dowód Przelewu_33001171023_pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'025'024 bytes
First seen:2023-10-18 16:11:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:VjrSytnscMpCiTVgfgBVF2ePgVaa4MF/0HoWq:VHSytnsbTVgQVF2ePAz4k/3V
Threatray 699 similar samples on MalwareBazaar
TLSH T1CC257E3D29B9263BC1B9C3A9CFE1C827F154996F3521ED6588C753A64342E4639C323E
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
322
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2465.30278.3934.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Creating a process from a recently created file
Creating a file
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/653003db368548c1702e82c6/reports/01f6d248-80e1-4f56-8bb2-508021b5b694/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/62534a146dc4b71bb4861d8924706ff594a92884257e540b6bd444e0b580f0f0
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9e15baa1-f1ef-4a42-bc99-cddd6bd3673d
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
n/a
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1328180
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large strings
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/62534a146dc4b71bb4861d8924706ff594a92884257e540b6bd444e0b580f0f0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/62534a146dc4b71bb4861d8924706ff594a92884257e540b6bd444e0b580f0f0/
Threat name:
Win32.Trojan.GenSteal
Create hunting rule
Status:
Malicious
First seen:
2023-10-17 21:26:27 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
22 of 37 (59.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mjjuufdnys3rxnegdwesi4dp6wkkskeeev7fic3l2rcobnma6dya._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
44af16d96fc65cae46f919ca9a465a90a984db05a5c6f60a9d7f8217d75a44e1
AgentTesla
4c586bb1d1197451bf41ce8be61cfa82d237ddbfcaf3815303d8ff393803721b
AgentTesla
57a285820956c77b8f6c8720ad8f2612d00012991d002b975cbb14310d481956
AgentTesla
5c485141f97385046d2a64a4a93c1ad50682cd97e3e5cbe1b3f6e9e0472efd56
AgentTesla
9fe9a0edbf56394c7f65764f1fe3a567ef7689716ee94cd1b415a00f907520bf
AgentTesla
c48248fb90e206349a782e77d256e3ea11fa13049a9f2047cb90f4eeb0e30eac
AgentTesla
d35dce5a33e43611c39ea134ece8746a4192f1bfd8c1577d7ebd77c0ebd66120
AgentTesla
e4c2c8f842ce22820f548ebae96def1fff8f86ce6c92adc4ff801d4adf46e1c9
AgentTesla
fec2fc59ff0deda9141200d10606ec0314a62f18a5b479e6438a13d8808d58ca
AgentTesla
+ 689 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/231018-tnh9wshd98/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
a19f222fba4296d42b1990e4fb09154123dd6d76d98e74d64ca4176b229875dc
MD5 hash:
f585acb790b54d819de9625a4fc3d3bb
SHA1 hash:
f19ab3f45e12a24ec7e163ca887627a12bf3db24
Link:
https://www.unpac.me/results/bd21a259-9869-410c-8cfd-25ca68380590/
SH256 hash:
d77813e8c036ffadde2a2484f9f19b1e297d26dacb8789b9146265b82310cf89
MD5 hash:
fb82282a7c2f53db9234c0e14f71c706
SHA1 hash:
c2ef4980853f77ebf2ebbb0632d33b38d44b1075
Link:
https://www.unpac.me/results/bd21a259-9869-410c-8cfd-25ca68380590/
SH256 hash:
de59c3246c72163cfc5d3b5a8aec72ec6a585893a6c7d80fbff35238aabe6027
MD5 hash:
c3b2bcacf04baacd6daae4cf4896872c
SHA1 hash:
b7815d4d77ea49e493898d9ce06061e2c9c83feb
Link:
https://www.unpac.me/results/bd21a259-9869-410c-8cfd-25ca68380590/
SH256 hash:
ed278807068709bcc74ef7d01ce46682b64d8ec9c8466dc8aaeb92ed75495aaa
MD5 hash:
51e85d063788811778e570139e28ac5a
SHA1 hash:
b3a9f24d4d25c91058e6c1f91e07219423b428fa
Link:
https://www.unpac.me/results/bd21a259-9869-410c-8cfd-25ca68380590/
SH256 hash:
a427688f9edaa10fdefdd82c4f74865996cc91fecd26e1d4e71595ea8f9820f1
MD5 hash:
98c83c1049b8f513577983c61c4f90ca
SHA1 hash:
8b2dfc9e1637f93009eea5168bab531209b6a58f
Detections:
AgentTesla
Create hunting rule
win_agent_tesla_g2
Create hunting rule
Link:
https://www.unpac.me/results/bd21a259-9869-410c-8cfd-25ca68380590/
Parent samples :
4c586bb1d1197451bf41ce8be61cfa82d237ddbfcaf3815303d8ff393803721b
62534a146dc4b71bb4861d8924706ff594a92884257e540b6bd444e0b580f0f0
SH256 hash:
62534a146dc4b71bb4861d8924706ff594a92884257e540b6bd444e0b580f0f0
MD5 hash:
adaa6e560706d818775dd346f31986e9
SHA1 hash:
80bcd55bcdd32ca2178b6f513950ac2a5594cf25
Link:
https://www.unpac.me/results/bd21a259-9869-410c-8cfd-25ca68380590/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/62534a146dc4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/62534a146dc4b71bb4861d8924706ff594a92884257e540b6bd444e0b580f0f0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 62534a146dc4b71bb4861d8924706ff594a92884257e540b6bd444e0b580f0f0

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments