MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a51412351320c2876dc38780b18441bbc160c6a0fa21bda69330eeaef1fb6ca6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a51412351320c2876dc38780b18441bbc160c6a0fa21bda69330eeaef1fb6ca6
SHA3-384 hash: c2f8ff91dbd4d6fc4ff1b0aa69a322490b6641cdde7e70507201166db24819e09a2671e19c2672ef3cf13edd28cf2ba4
SHA1 hash: a63dd8c4e01a12b67d753f016c74fee9c1563bf1
MD5 hash: b87802f432b8b8de6cce15128ba30007
humanhash: timing-iowa-april-cat
File name:PickUp Notice_HKGB88932410.xls.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:310'784 bytes
First seen:2021-08-06 14:53:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:8A1ijDCGvBowm8sokmuSmxH4mp4U4x56MA6JrFenPTG8kLQO0HFXxx2b:8XCsB/m19WjA+ibYQO0Z8
Threatray 7'955 similar samples on MalwareBazaar
TLSH T14664BF50AB030897C67C5237D257966FA3E08BB6E231C8AF7B4713C6A94D5462EF93C4
dhash icon 8f43484c4c4a418f (10 x AgentTesla, 1 x Formbook)
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
346
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PickUp Notice_HKGB88932410.xls.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-06 14:56:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4712e725-3d26-43bb-baf7-701d1bee9d9c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/177058/
Detection(s):
Win.Dropper.Nanocore-9831995-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Creating a file
Creating a window
Using the Windows Management Instrumentation requests
Sending a UDP request
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c5f00e54-6d2b-49a8-b3f8-6de7884e1f20
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/828386
Signature
.NET source code contains very large array initializations
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Suspicious Double Extension
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 460817 Sample: PickUp Notice_HKGB88932410.... Startdate: 06/08/2021 Architecture: WINDOWS Score: 100 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Yara detected AgentTesla 2->43 45 8 other signatures 2->45 6 PickUp Notice_HKGB88932410.xls.exe 1 2->6         started        10 winfiles.exe 1 2->10         started        12 winfiles.exe 2->12         started        process3 file4 23 C:\...\PickUp Notice_HKGB88932410.xls.exe.log, ASCII 6->23 dropped 47 Injects a PE file into a foreign processes 6->47 14 PickUp Notice_HKGB88932410.xls.exe 2 5 6->14         started        49 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 10->49 51 Machine Learning detection for dropped file 10->51 53 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 10->53 19 winfiles.exe 2 10->19         started        21 winfiles.exe 2 12->21         started        signatures5 process6 dnsIp7 29 m002.dapurhosting.com 103.7.226.89, 49763, 587 IDNIC-SDK-AS-IDPTSuralokaDigitalKreatifID Indonesia 14->29 25 C:\Users\user\AppData\...\winfiles.exe, PE32 14->25 dropped 27 C:\Users\...\winfiles.exe:Zone.Identifier, ASCII 14->27 dropped 31 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->31 33 Tries to steal Mail credentials (via file access) 14->33 35 Tries to harvest and steal ftp login credentials 14->35 37 2 other signatures 14->37 file8 signatures9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a51412351320c2876dc38780b18441bbc160c6a0fa21bda69330eeaef1fb6ca6/
Threat name:
ByteCode-MSIL.Infostealer.DarkStealer
Create hunting rule
Status:
Malicious
First seen:
2021-08-06 11:21:04 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uukbenitedbio3odq6aldbcbxpawbrva7iq33jutgdxk54p3nsta._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
10b9c66c17d2e559b0770c647386194546a4f64243e813fa2678cb7f7b16a5d4
AgentTesla
1f57778e5448ce6d8834f523299fc5ba868636556c993a4b5f3faabacb36c993
AgentTesla
359de4e28b1286f601c3d8cc5987ff8f81335f049411f00d99496c2f56bbade0
AgentTesla
5ac5eee21d5a32eb57d80ff83da21265c7d11c525f6b57ed124a266ce04fee54
AgentTesla
9fcdd20c1848723a889fd4ebb88e52a2cb9fae8ec9e8cfe70d8e9706ef3e8992
AgentTesla
d47da005885b968328d25d493a11e0fe3a146c9103f24b0de735a02b117c6a4b
AgentTesla
de9d415f8380055c8fc1a2239b7e1e85f29f0f1ba780c7bb2b9e2921dad93123
AgentTesla
e433b3cc952fec02984b9d3678ab71f9e168a5616550f44e7ab3b0548d01ed2e
AgentTesla
e860f949006657d88539f009376c3b6ed3947e81ddd1dcc2253f0c27b1945806
AgentTesla
+ 7'945 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210806-bnzpx8f43e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
b6b0f3ee5e72190f1bab87bde96f538bf66b12f755bb63a832e8e6857a77b26d
MD5 hash:
078545e31af8e4a5b74d573cb6b8f7f2
SHA1 hash:
1e5bf379d4122c94329c33e9d078d063a04d587a
Link:
https://www.unpac.me/results/7b562366-a5ac-43c7-b58f-6852f9bcb739/
SH256 hash:
2c19b1951e0a1951cf9a0ba2bf6ec9afa5cfacadc76ee022e7ec81a422425008
MD5 hash:
7b86bc52b3bd9ab911ee3b8591e247bc
SHA1 hash:
0249f5ea62ec169ec87b8346dbff72906fd6105b
Link:
https://www.unpac.me/results/7b562366-a5ac-43c7-b58f-6852f9bcb739/
SH256 hash:
a51412351320c2876dc38780b18441bbc160c6a0fa21bda69330eeaef1fb6ca6
MD5 hash:
b87802f432b8b8de6cce15128ba30007
SHA1 hash:
a63dd8c4e01a12b67d753f016c74fee9c1563bf1
Link:
https://www.unpac.me/results/7b562366-a5ac-43c7-b58f-6852f9bcb739/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a51412351320/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a51412351320c2876dc38780b18441bbc160c6a0fa21bda69330eeaef1fb6ca6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/177058/

Comments