MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 951e954efd63eed8d449ba0cfa84dc8ac70408f40fc3133189302b51d381c4a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 951e954efd63eed8d449ba0cfa84dc8ac70408f40fc3133189302b51d381c4a9
SHA3-384 hash: 86bb6262494658e32b6717b8a3320e3025ccae7b875bce8986e7605cd5a07ea70e58a7c7193045fe2fd9183772a488ce
SHA1 hash: 11a0c4170c8a19ce90a5afdbb19704a5c3327c30
MD5 hash: 72707f07599a75caf0bc676bde19eeb3
humanhash: wisconsin-alaska-speaker-yankee
File name:Shipping Details_PDF.hta
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'641'382 bytes
First seen:2024-07-01 14:18:01 UTC
Last seen:Never
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 24576:X9Unj8RztOCn/FpVtv31hQyiEqx4k9PG5jLfXq1qFLUxRfVBzBtXUmYRoHMBv:NBRztOCn/NV3vKqLfkq62Bv
TLSH T1FF75D012FA37D6A4F97A10EDE601096BBE5CE99410EBFB36E4ED04CD14F0523C498B5A
Reporter lowmal3
Tags:AgentTesla hta

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.VBS.Agent.BNG.20858.31138.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Score:
50%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6682bb194aef5fb03e2ed97awin7simulatehigh_evasion
Tags:
Banker Generic Network Dexter
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/951e954efd63eed8d449ba0cfa84dc8ac70408f40fc3133189302b51d381c4a9/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/6682baa521581a9281a090f4/reports/06668e7e-2d0b-43fe-a550-2abffd93b01c/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/951e954efd63eed8d449ba0cfa84dc8ac70408f40fc3133189302b51d381c4a9
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1465418
Signature
.NET source code contains potential unpacker
AI detected suspicious sample
Antivirus detection for dropped file
Machine Learning detection for dropped file
Sigma detected: Legitimate Application Dropped Executable
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1465418 Sample: Shipping Details_PDF.hta Startdate: 01/07/2024 Architecture: WINDOWS Score: 64 20 .NET source code contains potential unpacker 2->20 22 AI detected suspicious sample 2->22 24 Sigma detected: Legitimate Application Dropped Executable 2->24 8 mshta.exe 2 2->8         started        process3 file4 18 C:\Users\user\AppData\Local\Temp\x.exe, PE32 8->18 dropped 11 x.exe 8->11         started        process5 signatures6 26 Antivirus detection for dropped file 11->26 28 Machine Learning detection for dropped file 11->28 14 Fondue.exe 1 11->14         started        process7 process8 16 Fondue.exe 14->16         started       
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/951e954efd63eed8d449ba0cfa84dc8ac70408f40fc3133189302b51d381c4a9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/951e954efd63eed8d449ba0cfa84dc8ac70408f40fc3133189302b51d381c4a9/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=supjktx5mpxnrvcjxigpvbg4rldqichub7brgmmjgavvdu4bysuq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/240701-rl9myszcmm/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/951e954efd63eed8d449ba0cfa84dc8ac70408f40fc3133189302b51d381c4a9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:SUSP_OneNote
Create hunting rule
Author:spatronn
Description:Hard-Detect One

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

HTML Application (hta) hta 951e954efd63eed8d449ba0cfa84dc8ac70408f40fc3133189302b51d381c4a9

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments