MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85f930ad776dddefb438f34b214ac49424947ad306affe9dbb3d050fa0f565b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85f930ad776dddefb438f34b214ac49424947ad306affe9dbb3d050fa0f565b3
SHA3-384 hash: 5f3f184f7643e2909f0cb58efb5dad0d13446618b0dfc04d9e3502fb7ce4d0405b9762059e7b35fd82d813f051b29071
SHA1 hash: 12d3fb6006d0819fffef269660a0b5450013438e
MD5 hash: 38201a49d39a550eee3c69690882b48b
humanhash: sixteen-avocado-stairway-avocado
File name:DHL - OVERDUE ACCOUNT LETTER- FINAL REMINDER - 1300711528.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:744'448 bytes
First seen:2025-03-05 07:22:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'611 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:5/f+7pm+gvyYDFh4ihAbaWR5d/cQREDnI+0sWA1pQA0V2LXeGt5uWOpj0ib:ZFZh4i6baWR3cQRsh0M7QdhGvurj0ib
Threatray 4'557 similar samples on MalwareBazaar
TLSH T114F412386249D42BCD9597710E72F7B4227C5FDCB901C2978FEEBDABB966D140D20282
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter abuse_ch
Tags:AgentTesla DHL exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
450
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL - OVERDUE ACCOUNT LETTER- FINAL REMINDER - 1300711528.exe
Verdict:
Suspicious activity
Analysis date:
2025-03-05 07:58:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/35f4f9d4-4323-4c88-9bbe-490009b98f4b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3260.30608.9177.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67c7fe7fc8d04e92a4bf05c3
Tags:
stealer word msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade obfuscated obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/67c7fc013c5f644bd943a0bf/reports/7df0f35e-482d-47c7-8081-9c024ca49495/overview
Verdict:
Malicious
Labled as:
PasswordStealer.Genie.8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/85f930ad776dddefb438f34b214ac49424947ad306affe9dbb3d050fa0f565b3
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/205fe102-39fd-4eec-ad0b-e424338803d1
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1629833
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Scheduled temp file as task from temp location
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses ping.exe to check the status of other devices and networks
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1629833 Sample: DHL - OVERDUE ACCOUNT LETTE... Startdate: 05/03/2025 Architecture: WINDOWS Score: 100 56 www.fstudy.xyz 2->56 58 www.westende.live 2->58 60 6 other IPs or domains 2->60 72 Sigma detected: Scheduled temp file as task from temp location 2->72 74 Multi AV Scanner detection for submitted file 2->74 76 Yara detected FormBook 2->76 80 7 other signatures 2->80 10 DHL - OVERDUE ACCOUNT LETTER- FINAL REMINDER - 1300711528.exe 7 2->10         started        14 azJXpdN.exe 5 2->14         started        signatures3 78 Performs DNS queries to domains with low reputation 56->78 process4 file5 48 C:\Users\user\AppData\Roaming\azJXpdN.exe, PE32 10->48 dropped 50 C:\Users\user\...\azJXpdN.exe:Zone.Identifier, ASCII 10->50 dropped 52 C:\Users\user\AppData\Local\...\tmp64BB.tmp, XML 10->52 dropped 54 DHL - OVERDUE ACCO... 1300711528.exe.log, ASCII 10->54 dropped 82 Adds a directory exclusion to Windows Defender 10->82 84 Injects a PE file into a foreign processes 10->84 16 DHL - OVERDUE ACCOUNT LETTER- FINAL REMINDER - 1300711528.exe 10->16         started        19 powershell.exe 23 10->19         started        21 powershell.exe 23 10->21         started        23 schtasks.exe 1 10->23         started        86 Multi AV Scanner detection for dropped file 14->86 25 schtasks.exe 1 14->25         started        27 azJXpdN.exe 14->27         started        signatures6 process7 signatures8 68 Maps a DLL or memory area into another process 16->68 29 t3tx1I5A27KX11NmiE3GJ6N.exe 16->29 injected 70 Loading BitLocker PowerShell Module 19->70 33 WmiPrvSE.exe 19->33         started        35 conhost.exe 19->35         started        37 conhost.exe 21->37         started        39 conhost.exe 23->39         started        41 conhost.exe 25->41         started        process9 dnsIp10 62 www.amzavy.info 47.83.1.90, 65476, 65477, 65478 VODANETInternationalIP-BackboneofVodafoneDE United States 29->62 64 www.westende.live 199.59.243.228, 65480, 65481, 65482 BODIS-NJUS United States 29->64 66 3 other IPs or domains 29->66 96 Found direct / indirect Syscall (likely to bypass EDR) 29->96 43 PING.EXE 29->43         started        signatures11 process12 signatures13 88 Tries to steal Mail credentials (via file / registry access) 43->88 90 Tries to harvest and steal browser information (history, passwords, etc) 43->90 92 Modifies the context of a thread in another process (thread injection) 43->92 94 2 other signatures 43->94 46 firefox.exe 43->46         started        process14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/85f930ad776dddefb438f34b214ac49424947ad306affe9dbb3d050fa0f565b3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85f930ad776dddefb438f34b214ac49424947ad306affe9dbb3d050fa0f565b3/
Threat name:
ByteCode-MSIL.Trojan.Nekark
Create hunting rule
Status:
Malicious
First seen:
2025-03-05 05:30:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qx4tbllxnxo67nby6nfscswesqsji6wta2x75hn3hucq7ihvmwzq._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
2e4a8adeb10758473cd1d42e9869ee03840016814c6cfc0465303b19afaca46f
AgentTesla
65b7cf7ab546e94fad0cbce12c9756dcb2af4aa833943beffdfcc448e00e4449
AgentTesla
712b2ac1987715d8f00efee1564134d975790138d938cdd4dade04902db22b15
AgentTesla
e6a62cde2fa594e289dfdd4247f068ae5dc523174646615b312a20af28e90487
AgentTesla
error
AgentTesla
f4048c147a758eb5413a885a12c69fa5cd1b61668ae668942bcb7892e7f62584
AgentTesla
+ 4'547 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/250305-h77k2sstf1/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/729cabfa-d1cc-47b2-bcae-d7c778f3f610
Unpacked files
SH256 hash:
85f930ad776dddefb438f34b214ac49424947ad306affe9dbb3d050fa0f565b3
MD5 hash:
38201a49d39a550eee3c69690882b48b
SHA1 hash:
12d3fb6006d0819fffef269660a0b5450013438e
Link:
https://www.unpac.me/results/d8415ef9-713d-4492-a3f7-358e629e6eb8/
SH256 hash:
02a8adedddd22f4db760f88a4936e437c1de3c0258a2b581f89b2d48e3c6da49
MD5 hash:
35f8e529fb6fa4cac0d23e7c63db3095
SHA1 hash:
068bf79c8ec99b26358208d04474ef1408aa5855
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/d8415ef9-713d-4492-a3f7-358e629e6eb8/
SH256 hash:
b0977c1bef5200867b544af58559ce4fb0c5636a7fbdf7adbaed065d788a62eb
MD5 hash:
f7b65c191a0fe78422ceadd0bec03f5f
SHA1 hash:
108d6480e6ca5aafad1d4a91d76774e9dc1f67c0
Link:
https://www.unpac.me/results/d8415ef9-713d-4492-a3f7-358e629e6eb8/
SH256 hash:
ab608bea68aa025f85a499a38b2ba7d1494401b2811b2516e729b6163f55e0a2
MD5 hash:
b3ddb9697f34c56d94f8b2b3d3b9f18b
SHA1 hash:
63a428a65722ce363f9d33b9acccfc890ac31289
Link:
https://www.unpac.me/results/d8415ef9-713d-4492-a3f7-358e629e6eb8/
SH256 hash:
f86bbc3dca4273290678cfa3ed276a1343d3e09273a14558367ab404a4914809
MD5 hash:
7cb4da4b8b5f2094664d54ab5f44fde9
SHA1 hash:
6fc65224f0719014cbdae670a28bd7f389672ba5
Link:
https://www.unpac.me/results/d8415ef9-713d-4492-a3f7-358e629e6eb8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/85f930ad776dddefb438f34b214ac49424947ad306affe9dbb3d050fa0f565b3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments