MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62ada442852dbc19b06705e9c1357acacdc8a964d61402df870366989501d5d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 62ada442852dbc19b06705e9c1357acacdc8a964d61402df870366989501d5d5
SHA3-384 hash: 9795ce1800e51812e52e732bc70d3673e52b62b04c3c7488938d3ef098e485a3b7fc23f4acb629cc65b66349ff6bb238
SHA1 hash: d8750856976f3b9ab7992bcc7d29771f368e0e25
MD5 hash: b06265108843d75fb76e3e1069526cbd
humanhash: ceiling-magazine-sweet-video
File name:Payment confirmation.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:667'648 bytes
First seen:2023-10-18 06:32:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'737 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:9zfqBJa5hGGDNBRncBnUqbRAcVP4+qI/AJQWZgaqp9Lw+GKTaY:9T6Jeh3DNB1cBUqbRAS4+WK19Lw+ZTD
Threatray 38 similar samples on MalwareBazaar
TLSH T177E412207769CB29D5BA0FF54175E311D7F6AC537832E2691EC404EE4A77BA48220FA3
TrID 61.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.1% (.SCR) Windows screen saver (13097/50/3)
8.9% (.EXE) Win64 Executable (generic) (10523/12/4)
5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon cccccccccccc3345 (17 x AgentTesla, 5 x Formbook, 1 x Loki)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
333
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/455600/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/652f7c2eba877ae55910b4bb/reports/0dac33d8-4a80-43f4-bf6c-16d30a16e6df/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/62ada442852dbc19b06705e9c1357acacdc8a964d61402df870366989501d5d5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/120bab1b-1b17-46a6-ba2a-4d10e5cf05a6
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
n/a
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1327820
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/62ada442852dbc19b06705e9c1357acacdc8a964d61402df870366989501d5d5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/62ada442852dbc19b06705e9c1357acacdc8a964d61402df870366989501d5d5/
Threat name:
ByteCode-MSIL.Spyware.Taskun
Create hunting rule
Status:
Suspicious
First seen:
2023-10-17 00:28:53 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
22 of 38 (57.89%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mkw2iquffw6btmdhaxu4cnl2zlg4rkle2ykafx4hantjrfib2xkq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
1bcb883e07a0964b44b67c239b2134ee98d93a5df3bb0e7cb4c027d1373614a9
AgentTesla
29b23b45bbe02bff88d718bbc5fd3130d0da0801507fcf4697de838f12a3301e
AgentTesla
4f7ee7b035490423edd7b7c641b2ac81c192252de8c5ab2e40375274a170d5fc
AgentTesla
541d7866b5be3211823382c2f1de6bfb40e3830e7c442764f69075ba923d7d9a
AgentTesla
988ed9d6f58307ca4d5d42471240d5fbc37f31b5bc0e1007869ffc22f12571b2
AgentTesla
a915e631517c5b9eadd5062e2c12d33521950a2650d56e69f60ed0d783f35345
AgentTesla
ac10fa3a6b7cfc8385aba614ca8f0da49fe6b0cb6f1b939ec0f0046ecf80ca64
AgentTesla
e41ce47cf174f8b3f909756c90495e990b4f5550da4bd7e1a6b5ba50ba0ba9e9
AgentTesla
ea2adbcb61a20497bc442d31600336a93659f5b38ee367fa83c0a996b0912e83
AgentTesla
+ 28 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/231018-ha9zxadc66/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Unpacked files
SH256 hash:
364d942e46a65cdf7270f4a11e11ddb9f4049369b0e235303c0ae51de483a63c
MD5 hash:
ff951a1523ac712b9735b27a3ed48897
SHA1 hash:
ffe74efc923b4997241d6e96689bedbcd8ff868b
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/698ba218-04eb-452d-a105-5395d5ab7317/
SH256 hash:
828334475398c1664fc5e5e15712e6b7f28a7f56559c5903d0b00d0da558bcd2
MD5 hash:
432f83fba346b8d97bc8a7d3b519c478
SHA1 hash:
42232ecf4cb3dc64346ffd34d8b384248c726309
Link:
https://www.unpac.me/results/698ba218-04eb-452d-a105-5395d5ab7317/
SH256 hash:
b1270dc9ec3f22c6fd2296239426ac7c48589589580d4a1b3da8188920b22a63
MD5 hash:
5c904da8528cfb1b87b15a6aa7c059cd
SHA1 hash:
f0a192969485d1bc34bf52adf37d9c20176d6b85
Link:
https://www.unpac.me/results/698ba218-04eb-452d-a105-5395d5ab7317/
SH256 hash:
be4b62dde8ea819da76e898b0e64a7858be2e5f598233ed0d5474e0996db52b1
MD5 hash:
9aa83a0233f21419a96f5a1201adb4aa
SHA1 hash:
7fa0fe91070505550da96f11698259749ba824db
Link:
https://www.unpac.me/results/698ba218-04eb-452d-a105-5395d5ab7317/
SH256 hash:
e5cadb74f7b3774245f49224fed7e51a86d392b29090da9b59dcc01396584d3c
MD5 hash:
758af111a3119bc1064939814a97a4ce
SHA1 hash:
7eb037c8247949345d0cc762e7468018a1f8e733
Link:
https://www.unpac.me/results/698ba218-04eb-452d-a105-5395d5ab7317/
SH256 hash:
d3d402d0b8000a2431ed59f06c30bf121795535cf64b445fcf6c4d02ed71f7a7
MD5 hash:
6147d659fd5cbc6b0e37e40ec84d222b
SHA1 hash:
f23618a3a468e3b02b18d96fad10564b5e269942
Link:
https://www.unpac.me/results/698ba218-04eb-452d-a105-5395d5ab7317/
SH256 hash:
05761e8c3ff924f0e7b0f476ac5b37f7cc1ad2cdde92b31ee9faa8bfbe685152
MD5 hash:
964d6b7dd7d4fe95216ff02a130e36ea
SHA1 hash:
eefc3b2292958cdae96bfee6c62f8600a64103de
Link:
https://www.unpac.me/results/698ba218-04eb-452d-a105-5395d5ab7317/
SH256 hash:
683d2219a8029ce36c0fe6682b277b0d80dc78c06e284c2900a06bb4e9745781
MD5 hash:
01530902f423837d228624d454686417
SHA1 hash:
b44dc2c704e398b94859042e28c7272c86bf4040
Link:
https://www.unpac.me/results/698ba218-04eb-452d-a105-5395d5ab7317/
SH256 hash:
de12029eb0431c9c7bab96e82812b83eca83a9236cbc90584d54859c4898eebd
MD5 hash:
6e7eaa5e6cca091e8ce413e37b94c7da
SHA1 hash:
7b8252769cd49be34f39a14e1b7ecdbe043a8069
Link:
https://www.unpac.me/results/698ba218-04eb-452d-a105-5395d5ab7317/
SH256 hash:
e14df4f2ea925ef1f2fc21894e552c405db7b9aceec210a01ff068f3fc76cc97
MD5 hash:
d60fc96998014c85954c192e92e7b039
SHA1 hash:
74ccaacb28d1bf7d10ec2c022d5bbdfffba2f513
Link:
https://www.unpac.me/results/698ba218-04eb-452d-a105-5395d5ab7317/
SH256 hash:
c495911af5d21b4279ea230e81c214cbf9b528c49a26614437456118e25aed2e
MD5 hash:
21188298840b58f8390756f96ca1fa8b
SHA1 hash:
091bbefb4f99265cdbd7b81ff4d566a77a5a4e37
Link:
https://www.unpac.me/results/698ba218-04eb-452d-a105-5395d5ab7317/
SH256 hash:
62ada442852dbc19b06705e9c1357acacdc8a964d61402df870366989501d5d5
MD5 hash:
b06265108843d75fb76e3e1069526cbd
SHA1 hash:
d8750856976f3b9ab7992bcc7d29771f368e0e25
Link:
https://www.unpac.me/results/698ba218-04eb-452d-a105-5395d5ab7317/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/62ada442852dbc19b06705e9c1357acacdc8a964d61402df870366989501d5d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 62ada442852dbc19b06705e9c1357acacdc8a964d61402df870366989501d5d5

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/455600/

Comments