MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a53c05c8b0af4a3ba533e91ce92cf6f438df667a2ab15bccd7ea7a743eaeea29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a53c05c8b0af4a3ba533e91ce92cf6f438df667a2ab15bccd7ea7a743eaeea29
SHA3-384 hash: aef5266301bf2e1b946fd4342dcf26d022bc68befc6293b9e352e3a7eab23dc442066bdbcc0bb97b7c4dc12590b0f82a
SHA1 hash: 4e153fc531166101822d64ed42a3871b406ddb32
MD5 hash: df16bd302d7399c046cb139483ad8999
humanhash: edward-one-winter-hydrogen
File name:DHL Parcel - SGS.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:724'480 bytes
First seen:2023-09-29 11:28:14 UTC
Last seen:2023-10-09 05:28:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:icxAckjh4OckuLtvdau4E/eBFP+iCP0KbvIGCLpeoAoeK9OUNJnwtyLjw5wVd:hkOtrLR4UYFmt7bfCLphAop9hJnwtyLj
Threatray 5'661 similar samples on MalwareBazaar
TLSH T118F412022BA515C0F6BB633545B2113143F7AB62CA7CDE5D0CDC619D2BEB361AA14FA3
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 229878f8b4f031c4 (24 x AgentTesla, 5 x Loki, 4 x Formbook)
Reporter abuse_ch
Tags:AgentTesla DHL exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
279
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/451929/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/6516b50033582f234e06dfb9/reports/f4c7336d-0f5e-48c4-b2f5-4f2041d971bc/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/a53c05c8b0af4a3ba533e91ce92cf6f438df667a2ab15bccd7ea7a743eaeea29
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/99ac3063-5516-4592-ae51-0c60e98ff617
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1316457
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a53c05c8b0af4a3ba533e91ce92cf6f438df667a2ab15bccd7ea7a743eaeea29/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Suspicious
First seen:
2023-09-29 03:01:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
12 of 38 (31.58%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uu6alsfqv5fdxjjt5eooslhw6q4n6zt2fkyvxtgx5j5hipvo5iuq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3c3bfc4353b8c082ab7c4202df58d8008cd322258c4c5505d387cf3a128b78ee
AgentTesla
4a6391439592ce3581a5d2c8f6195cc7e582d69222cf0e23d6bb0e8962abd1c2
AgentTesla
5c052358e586f6c13f6b87a424648e4a36629f3998cb90baf6372e1ce37b6920
AgentTesla
7deb65a2ec42de8489a8b8283a8927b3ec8301e4297e5daadc58f172b9c289db
AgentTesla
d56f7dbd535d973bc8b14f22c58ab9c658e0bbe3f3139e7c16c619dba98ec664
AgentTesla
db44e1da719b971f2fb5919d535170aab2779e13ab8db9e04e054c6efd4dff65
AgentTesla
+ 5'651 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230929-nlkr2saa9z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
5ab11a933c95891b62f1ba94f38cdf01ded8f19061946601670c430d084dd007
MD5 hash:
24e1d07ed94115e19deac95b30c3af96
SHA1 hash:
bb6c15b4d1cbc2b3307a58af6d0c3d5ec6ce4e09
Link:
https://www.unpac.me/results/d3e88bfa-efff-4ccf-812b-853931d1f8be/
SH256 hash:
5e0c06d98e60e9bd5fbcf92f2a8bc06b193e5aa4f4dc618866de27f90dc311d6
MD5 hash:
380cfbf7b69cffcbc6bdf7fb6a7b2e16
SHA1 hash:
95b7f8b928a7f9732a88b72f98047b3855f57e86
Link:
https://www.unpac.me/results/d3e88bfa-efff-4ccf-812b-853931d1f8be/
SH256 hash:
bc6e1487bee00a8fd2b639ee4e60867d7e409bd3cb6be1451f5ddbce26340766
MD5 hash:
fe233bfa89c7e26811c45fec198f7937
SHA1 hash:
6f0af0f155b841786f43b01e0c1c033aa277cdbd
Link:
https://www.unpac.me/results/d3e88bfa-efff-4ccf-812b-853931d1f8be/
SH256 hash:
03ff41a8d86c07834335ee0212afb102830f41970064e5a1516479232b76af33
MD5 hash:
03ccfe4dad17a82b4ab5d2acb81798dd
SHA1 hash:
46b1c9144ff038807da750411413408228d95b77
Detections:
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/d3e88bfa-efff-4ccf-812b-853931d1f8be/
Parent samples :
5c052358e586f6c13f6b87a424648e4a36629f3998cb90baf6372e1ce37b6920
a53c05c8b0af4a3ba533e91ce92cf6f438df667a2ab15bccd7ea7a743eaeea29
d38668af94d8c3a29626ad116494d55060fd2f2dd9e8f824861fe621599c4b63
2e68f9ba9b0eea70dc6a43c56ba183728769293feb53d1ed73f1b41097213587
SH256 hash:
8a9b7558728161e7f3c6763f9b49944e8a0abb150c9fa4d66d3b0380a1ec4d28
MD5 hash:
08a1f08dd04f21f95e004922a246a477
SHA1 hash:
13b06438a233c86d0afbb1ecf4ed47dc821921e9
Link:
https://www.unpac.me/results/d3e88bfa-efff-4ccf-812b-853931d1f8be/
SH256 hash:
a53c05c8b0af4a3ba533e91ce92cf6f438df667a2ab15bccd7ea7a743eaeea29
MD5 hash:
df16bd302d7399c046cb139483ad8999
SHA1 hash:
4e153fc531166101822d64ed42a3871b406ddb32
Link:
https://www.unpac.me/results/d3e88bfa-efff-4ccf-812b-853931d1f8be/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a53c05c8b0af/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a53c05c8b0af4a3ba533e91ce92cf6f438df667a2ab15bccd7ea7a743eaeea29

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe a53c05c8b0af4a3ba533e91ce92cf6f438df667a2ab15bccd7ea7a743eaeea29

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/451929/

Comments