MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb345b80cdf6adf22b29c8885aa0eaa4dabff5fd66cc766c322777ac85b246c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb345b80cdf6adf22b29c8885aa0eaa4dabff5fd66cc766c322777ac85b246c7
SHA3-384 hash: 08f3b08e355a6d6d340e003b6da2dce9b6402d3035e6f3b154a65175084263e9f4d667eeb23cce66dcd94f7b345f69df
SHA1 hash: 0ec9ba2752e6701673995ea3742569c0603ec49a
MD5 hash: dcff0fe386a45b55296cb896f6939991
humanhash: december-winner-texas-leopard
File name:DHL Express Receiptss.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:680'448 bytes
First seen:2023-09-01 20:06:32 UTC
Last seen:2023-09-05 11:42:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:tefOZ1T6ceVOlgkMY5qF8WTZE37wQMMicufTYyu+OJWwFsxnYjH4QN5:kWZccY3YVoMkQscufcyu+vwCxnOHJ
Threatray 5'658 similar samples on MalwareBazaar
TLSH T1C6E42201B2E01A13D276E3BA5395336403F0B769B737D56EBDB022C4A766F254C813AB
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter abuse_ch
Tags:AgentTesla DHL exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
283
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL Express Receiptss.exe
Verdict:
Malicious activity
Analysis date:
2023-09-01 20:21:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7d6ee6a8-2a6e-4e40-93b2-23e0728da817

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/445687/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Porcupine.Trojan.PSW.MSIL.Agensla.164041.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/64f244684578d9c35efef689/reports/524548ab-9a0e-499e-9afd-05624bd59559/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/bb345b80cdf6adf22b29c8885aa0eaa4dabff5fd66cc766c322777ac85b246c7
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f3bffebf-26d1-4aa3-b259-c3e11c7228cf
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1301913
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb345b80cdf6adf22b29c8885aa0eaa4dabff5fd66cc766c322777ac85b246c7/
Threat name:
Win32.Trojan.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-08-31 08:28:02 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xm2fxagn62w7ekzjzcefvihkutnl75p5m3ghm3bse532zbnsi3dq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1496cc2741444b58ba3815b091ca257bbd9f17e85ba4d00fc26d725b6b8be422
AgentTesla
346819703871e4709fedc019c2ff077dc7976162e25bd7edf75bc62708b769d7
AgentTesla
48173b1ba1c44cbd6cce2a43a6ed54c7300164c13a7ddf8b217c9ac08205d517
AgentTesla
533522ee0e78efec4fd818e102051957fb0c93cbf8aa2adee2a3159c47d5ad30
AgentTesla
5dd81b46f9b2a310868ab2b1ea4d61619ab039d8d19e8abff4a559930be4fe19
AgentTesla
63cf3e5bea889ee1908809093af3a904ad23bf5aa4222619a21aaef268c2bc6a
AgentTesla
a3a30f5a6bcfcd96305e17acaba93ceb8e59b484e7ec4b9dbf0d8db7ccde01ff
AgentTesla
c0cdbf1f06967ed21beeac44d82b6fa168ec433ee130c042c6ffaf16029d9003
AgentTesla
c3d7784b55f0d1d5bc37f3d850039ccac92dfd94257ccd4b8fe04307ad46d617
AgentTesla
e4bf2c0f2c23c761983ab4c03f287d5692a1446a3087bf043d7fefde261b8e6f
AgentTesla
+ 5'648 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230901-yv16hahg73/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://discord.com/api/webhooks/1145377925911290017/Z97pWUel52_tvWrOxk5XM_0ix9wRotIAl7h7K28Vywe0zXm3VwLHM3OoIEB0RzM-IrRE
Unpacked files
SH256 hash:
892761d55890a0af5517cc5da1b7b251539f9d1b5e126616def3b66b60b25f50
MD5 hash:
1381fe1ab71c80397a78422051edbd51
SHA1 hash:
e258e5a6e54f6314944e713515d22906fa4520f7
Link:
https://www.unpac.me/results/a3174074-853a-45c1-b256-42e1eb57f19b/
SH256 hash:
a645509dfc38de301048514cb6dcc0a5900b0162848b37f857c262b6b9de6075
MD5 hash:
df07755e4b347bdfde17c2c569966dad
SHA1 hash:
8fd371c43850cfad1c68c45dee04b5bc9341a576
Link:
https://www.unpac.me/results/a3174074-853a-45c1-b256-42e1eb57f19b/
SH256 hash:
c094444932babf732e788625413d66665af54fa789015decb7e2da3d3ab25dc3
MD5 hash:
49204dbac9267797c9f6679a4bac06ec
SHA1 hash:
5590f19a53f6e6a88d14adfbc83ea1cd7ae002c7
Link:
https://www.unpac.me/results/a3174074-853a-45c1-b256-42e1eb57f19b/
SH256 hash:
c7e061fbc319294686d28f771d0e7db9cb9f711a455f06bffddcf21f3659ef49
MD5 hash:
dd43eef0094c13db3850c131fa9f74ae
SHA1 hash:
21cada4fb0116d8c3ecb1bb5663adfbe145998eb
Link:
https://www.unpac.me/results/a3174074-853a-45c1-b256-42e1eb57f19b/
SH256 hash:
bb345b80cdf6adf22b29c8885aa0eaa4dabff5fd66cc766c322777ac85b246c7
MD5 hash:
dcff0fe386a45b55296cb896f6939991
SHA1 hash:
0ec9ba2752e6701673995ea3742569c0603ec49a
Link:
https://www.unpac.me/results/a3174074-853a-45c1-b256-42e1eb57f19b/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bb345b80cdf6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.67
Link:
https://yomi.yoroi.company/submissions/bb345b80cdf6adf22b29c8885aa0eaa4dabff5fd66cc766c322777ac85b246c7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe bb345b80cdf6adf22b29c8885aa0eaa4dabff5fd66cc766c322777ac85b246c7

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/445687/

Comments