MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4353534a3286e4744c56adfa83a4291eaaba9ae93e41454fdb99d016f7cc927. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4353534a3286e4744c56adfa83a4291eaaba9ae93e41454fdb99d016f7cc927
SHA3-384 hash: 7b72e54158dc54af9c4a9373c7efd9f2625d6a0951975d3f8d79fe4a8e8d740383bae950aea7836c2d75da50cf1a01a1
SHA1 hash: 38250a6458fddf5a7b3e79dbbd5d29a7e642b10c
MD5 hash: d7fe80cb7a12f754d335c3d9201b3563
humanhash: carpet-lake-kilo-charlie
File name:DHL Receipt_AWB8114704847178.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:782'848 bytes
First seen:2023-01-17 07:00:44 UTC
Last seen:2023-01-17 08:42:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:OxKXJIzLBwwnu0b9jn3z8lRkizYNmmRtw9ujOroYg3kZNyK5idbNoexY/ZTlNV:oBww3B3glRb4mmRtWrov3kHyK5YNNx83
Threatray 24'278 similar samples on MalwareBazaar
TLSH T15AF46B410A7B86E2D4F90E78163C68142BA15CD18BACF13ABDC67DBA9CE774F0095723
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
219
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL Receipt_AWB8114704847178.exe
Verdict:
Malicious activity
Analysis date:
2023-01-17 07:03:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3a35ec12-9883-457e-a56d-fdb77462b721

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/353684/
Detection(s):
SecuriteInfo.com.Trojan.MSIL.Basic.5.Gen.4273.13275.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/63c647b1232f8436851eab82/reports/e29825d3-bff5-4ca1-8644-f16ee2391d28/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/02a87d60-4c12-43f6-a8bc-45168bb55264
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1152832
Signature
.NET source code contains potential unpacker
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 785564 Sample: DHL Receipt_AWB8114704847178.exe Startdate: 17/01/2023 Architecture: WINDOWS Score: 100 45 Snort IDS alert for network traffic 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 Detected unpacking (changes PE section rights) 2->49 51 12 other signatures 2->51 6 Skype.exe 3 2->6         started        9 DHL Receipt_AWB8114704847178.exe 3 2->9         started        12 Skype.exe 2 2->12         started        process3 file4 53 Multi AV Scanner detection for dropped file 6->53 55 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->55 57 May check the online IP address of the machine 6->57 59 2 other signatures 6->59 14 Skype.exe 14 7 6->14         started        31 C:\...\DHL Receipt_AWB8114704847178.exe.log, ASCII 9->31 dropped 18 DHL Receipt_AWB8114704847178.exe 17 10 9->18         started        21 Skype.exe 12->21         started        23 Skype.exe 12->23         started        25 Skype.exe 12->25         started        signatures5 process6 dnsIp7 33 192.168.2.1 unknown unknown 14->33 35 api.ipify.org 14->35 37 api4.ipify.org 64.185.227.155, 443, 49695, 49698 WEBNXUS United States 18->37 39 api.telegram.org 149.154.167.220, 443, 49696, 49697 TELEGRAMRU United Kingdom 18->39 41 api.ipify.org 18->41 27 C:\Users\user\AppData\Roaming\...\Skype.exe, PE32 18->27 dropped 29 C:\Users\user\...\Skype.exe:Zone.Identifier, ASCII 18->29 dropped 61 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->61 63 Tries to steal Mail credentials (via file / registry access) 18->63 65 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->65 43 api.ipify.org 21->43 67 Tries to harvest and steal browser information (history, passwords, etc) 21->67 69 Installs a global keyboard hook 21->69 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4353534a3286e4744c56adfa83a4291eaaba9ae93e41454fdb99d016f7cc927/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-01-17 01:44:52 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wq2tknfdfbxeorgfnlp2qoscshvkxknospsbivh5xgoqc334zetq._file
Verdict:
malicious
Similar samples:
011c5a93fcf5f1fda343e254b6be02737381be4df4bdec1aa07c8ad23b540599
AgentTesla
11b9f67eb281cdf13dae80e0e6b549755355ffe3774a0ee63f902adf522615c3
AgentTesla
2e6e7a03046940761b6d2c75a14c6a01a9e31497053de523ef292d643c30e9a3
AgentTesla
4bc8d672419ca70beec67b6923dafa4509b7449fe4df575b8b6aa099d99abfee
AgentTesla
6600f2c51ef233a254c85c0a3070eb9a81046692dd9918de53213c23e26a733f
AgentTesla
a1b4b59ce0ed13e04420c13bfcb67c099ba6b60d1f7710d85fb4c8eb071bbc39
AgentTesla
c5b6ea68053365671ff834b433e8a428e038f862cf3b71cb80b3e7ec230f9651
AgentTesla
d9af5663675ec30a081fa6eb8c5c94e9e0b89201aaed50ee13381bf968704bcf
AgentTesla
+ 24'268 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection persistence spyware stealer
Link:
https://tria.ge/reports/230117-hs8jssfg3z/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Reads data files stored by FTP clients
Unpacked files
SH256 hash:
54d781f0dee6692c47390edf1ada295fb17a7e80ed5ccd58ab14c6ddf80a0ad8
MD5 hash:
4f6caebd865502f7c8046fbae3284c61
SHA1 hash:
be357e832bf6f61454875b37a1759cf1c5fa5ca4
Link:
https://www.unpac.me/results/809314be-e98f-4603-85cf-a65521b9c593/
SH256 hash:
3a1108ba9eb7617758c85b4795254d0b012a05d4acb5462d39363dc9f77e5eb5
MD5 hash:
8e5d2da72113328b9dbc4fd1b1ac94b6
SHA1 hash:
af5d6eb888a1646618f9b2d31f4a9dad6bdecd94
Link:
https://www.unpac.me/results/809314be-e98f-4603-85cf-a65521b9c593/
SH256 hash:
17ee69de3ae14f12e049223d818052deac2b801683753682eb89ced9df3f0f05
MD5 hash:
ea873185854aa936a8d11f0b10ffaf23
SHA1 hash:
805c015c720a45027041b89bd6eed6f681e16c50
Link:
https://www.unpac.me/results/809314be-e98f-4603-85cf-a65521b9c593/
SH256 hash:
5091c58d295d0ca472a11609a88dbe620e7f24e53364b77e4998ba4c95cdf2bb
MD5 hash:
4869087b338b1577850550f7956dc556
SHA1 hash:
421a2299c4b8287fc4c32305f223d7e7a8fb95f0
Link:
https://www.unpac.me/results/809314be-e98f-4603-85cf-a65521b9c593/
SH256 hash:
a20bfc47f33237e7066f9ff3fbf1d2c6774002ca937b3755011b78a614a979ed
MD5 hash:
2a61bac67f2d70e426a17e0313d47726
SHA1 hash:
124a427ac24b8346f970f7493818fd4769e2d477
Link:
https://www.unpac.me/results/809314be-e98f-4603-85cf-a65521b9c593/
SH256 hash:
b4353534a3286e4744c56adfa83a4291eaaba9ae93e41454fdb99d016f7cc927
MD5 hash:
d7fe80cb7a12f754d335c3d9201b3563
SHA1 hash:
38250a6458fddf5a7b3e79dbbd5d29a7e642b10c
Link:
https://www.unpac.me/results/809314be-e98f-4603-85cf-a65521b9c593/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b4353534a328/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/b4353534a3286e4744c56adfa83a4291eaaba9ae93e41454fdb99d016f7cc927

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe b4353534a3286e4744c56adfa83a4291eaaba9ae93e41454fdb99d016f7cc927

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/353684/

Comments