MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fca4e12e29cf37dcc23a48f671c5dd7f8f4d473bba7754091ca1287d2b124205. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 17

Intelligence 17 IOCs YARA 7 File information Comments

SHA256 hash:	fca4e12e29cf37dcc23a48f671c5dd7f8f4d473bba7754091ca1287d2b124205
SHA3-384 hash:	f171500dfdb9d58b835c12bf59cfd1dea00f9be7a2a2c76494f2f052942d421bdf6ef12792acfd0e283e261fe1e7843f
SHA1 hash:	2679e89e995227a53db1c8e0ea109cf46f8f07e8
MD5 hash:	cb8f38ee0a74699f0aa3fa77010bfa8d
humanhash:	nevada-friend-cup-music
File name:	FedEx Receipt_AWB#53021024643.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	712'712 bytes
First seen:	2024-03-20 07:11:35 UTC
Last seen:	2024-03-20 08:27:50 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	12288:SaUqvAxb1kz0Mb6LoreEyPLyvDfhwG+wddNWwn5jJ+oqDisfRkJANb4eEkR:SaUqvAxb1ZI6DEyPLGfht+wfNWqqes6k
Threatray	4'745 similar samples on MalwareBazaar
TLSH	T1EEE423023AB81567EAB5E6F085FACD412B7172633740C3DD6DC5228AA4DEF224629F17
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	cc948b667969653c (13 x AgentTesla, 5 x Formbook, 2 x RemcosRAT)
Reporter	abuse_ch
Tags:	AgentTesla exe FedEx

Intelligence

File Origin

# of uploads :

# of downloads :

342

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

fca4e12e29cf37dcc23a48f671c5dd7f8f4d473bba7754091ca1287d2b124205.exe

Verdict:

Malicious activity

Analysis date:

2024-03-20 07:42:37 UTC

Tags:

stealer agenttesla

Link:

https://app.any.run/tasks/f5a62360-0e82-4540-afb5-798766a5a7bf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Porcupine.Malware.58887.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Reading critical registry keys

Setting a keyboard event handler

Stealing user critical data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

masquerade overlay packed

Link:

https://www.filescan.io/uploads/65fa8c4a0ef6f5eba4953c7b/reports/26d5cf00-763c-46a8-bd0e-c97f33dde12e/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/fca4e12e29cf37dcc23a48f671c5dd7f8f4d473bba7754091ca1287d2b124205

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e89b5c15-de37-4eb1-b7e1-931fc94df144

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1412185

Signature

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

Score:

95%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/fca4e12e29cf37dcc23a48f671c5dd7f8f4d473bba7754091ca1287d2b124205

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/fca4e12e29cf37dcc23a48f671c5dd7f8f4d473bba7754091ca1287d2b124205/

Threat name:

ByteCode-MSIL.Trojan.GenSteal

Status:

Malicious

First seen:

2024-03-20 03:10:20 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7ssoclrjz435zqr2jd3hdro5p6hu2rz3xj3vici4ueuh2kysiicq._file

Verdict:

malicious

Label(s):

agenttesla_v4

agenttesla

AgentTesla

268df61fa4fc10d350f4ef84296250ecbfffcdff8ee993ddfaa9205aeab835f6

AgentTesla

9186054821ebdb3ab0b330686697afe855a33742a51456ac55a8b172d246eef2

AgentTesla

d172a99be3a242602683908e636d281504ae75bc8b54b8fa2b22356f445da957

AgentTesla

ffe2f8fec7f9ba8ff7877c6913820df6048f6d3df97dedf8d81efc3a51baba87

AgentTesla

+ 4'735 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/240320-h1h9waca9v/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

975d5c095a6bd20d20d1553f0ad36795517087712bdc2a18fb8516665539242e

MD5 hash:

53106229a87e970b8befe76d9118f647

SHA1 hash:

f4965d92934d4acff7ad5f4f9521a1b8fb584798

Detections:

INDICATOR_EXE_Packed_SmartAssembly

Link:

https://www.unpac.me/results/19483223-f010-4941-8a12-33ed63a00032/

Parent samples :

37899fda8cbf74882ae5d68bcd1de525005edfb8b5b87edd42fd86c458bb998f
71ae98c7e6f3e776c17594e8007ecf47ea0209f0ca1142515e4958c02267bed9
5f834237db6598266c1127b74062bd1d92150daf483ccdb0b37f1d306494a5a4
296d5ba75c695171bc26ce33a02e4b16818bddcfdb7688011d741fb78d3dab18
fca4e12e29cf37dcc23a48f671c5dd7f8f4d473bba7754091ca1287d2b124205
d334afd3da3c629abf0772c5be572d1d7b252b9a1ad2fae0e1809d04635f3e4b
bd9a2450499f87561deff9f7862b4ca34b5afb27089b8ae90578f7ed28054808
0a2d5142d03f0dd333f371e089c5f0d5fe8c3169e4ee78d7ca23b1472b2f7b48
27aca3b944c0bbd1b6d020de7a9ef916ba170e017ba63304adfef012822cf20f
7beb85da1bc8b1c935309f219347d8534a77ba114ca4217bd60f98b4ad05836e
a775277953ea0daab3cbec4aa2b37c5e0052172c05f7d4d0e8c39894c58fabe0
771c49d7430b930313e8af81f4b89fefd3d6b6450fceab630b125a6a6d4cf11c
8d5930353d2239c66b566cb6725058657d642d766549d493f0118aa495c95106
aa33486e9090a3807a894ba0c8c918668821875e0df7a15574ea412489673e3d
f6eea72845ed2286d5faf76e537b1e94081c2fea7be4772c5f63a04e6a847795
cb348e8dbd6c518a9ad671a9fb235cea3eeba8b7036fc5498f6b118d4bc3060b
90f4e7731fc41021b7ce9f9d15704c9849cf3215161585721a370745f7392e71
d85a4e28a6003aaf9cf0a6c0bf3f5bee31eb82f39930f8ecec7657dd24093c49
00d1bd4fb6f0afc0345136a810f410fb2c1740fd8adf0793e3cf6597f9bc7447
53cbb972306a7569a1762feaa5df42ad66de898691b4cabcf1c2c35526361d8e
fb73c562937a21c54247a51c05d0e616148301cfdd24b1619f0e13191a3ab687
fc9a9c10b989fb790466a432945be2a122151bd634013222bfd87469a9f4d584
a898ed790cde47b79f0c27f18406d6e290178bea8c35788d5ac22622cfadf2b6
ad048fa92eef59c07432e25c1afa2af4853be0a301e3ea64910352373fdea51c
5762147a28aaed979353975b6f7e2d31d71fb827af0dafb991b442c30e161caa
1c98180948dc869d00e1fe42476559fae2d76e95ce809c47736aca2ed6c20970
4af0ad255ce753c34b265d5714681b436ef635cbfc8dab10349ea913547be805
b21d51bd3eae9c07144b4d2527d732227a775c18e42812eea7a6f3a84c4d3a2d
86cc6304f5610bd7836b6706c2fe5d5c1fd88ad5de23927e41a1848dddf744e1
35283152bb31940827ea64cdef4baf0f332f38b348d83dd3c34364b97f6d3d87
9dfd52d9008fad9915a2ce18b0f9e9a2dc6c513f7396d049a82faf97410950c1
2c86d6d8fe9b19bd2f24d6e424c90b9a4bee255cb10e8319427d689d32dbfc60
d24bd0ebc242b94f043fe80e7f6a48d20566689f31c55aa1ec910a2877ae9e28
b6d91bc05bcc51b0a9e9f6e605493168b1a78ccd6f234030d05461e12544cffb
dce7d8b9beeb107ab7520818cbba375962e1c6e8ace6020d1a344446498260ac
a5810d5e9262b17b5506cbfc546421debd1ddbb593ae8440c2b39793044200df
a25bdcab7a38affd0798e5d674341724726c866e7cd7348b3d75bdb47ccca230
8094dba1e87d004dcade1f0c8c15b78af99e3568d7912fa7b85cafd1e88bc83b
e1ce37159aa3f3e141d622216cc4994b7fa4014e8b094b56f34916bcd838b872
c7a16881f8c69d16a9b0bdcbfdd5c4aada81eba19521d1c03ee7f6005f7d6629
adeebc489ed24b4e3e8ca7d0db2a4fe9bfce24c7c7675d67d57712afce862a72
454e87da084f762d25dcb7858795f6bb6cd549cc0f1435177121b0eb66c17743

SH256 hash:

14e5d130f07dcfbff652f6a37f99f30410b3bfc05a0c0817fa730d43e764c3f0

MD5 hash:

85e39b4dc707b7af94915a10de77f797

SHA1 hash:

d0a11475d3c2a2ec0092bed3eb426e443b25976a

Detections:

AgentTesla

win_agent_tesla_g2

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Agenttesla_type2

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Link:

https://www.unpac.me/results/19483223-f010-4941-8a12-33ed63a00032/

Parent samples :

9186054821ebdb3ab0b330686697afe855a33742a51456ac55a8b172d246eef2
904b3bd6dc96843fa949ece4b33ef83650d2f735f0caac028cd3384e864ef8de
fca4e12e29cf37dcc23a48f671c5dd7f8f4d473bba7754091ca1287d2b124205
4a24e019d09e4e0655cd1eb40bc2a335aaa9fc6045f0fb5179cf702635e37f3c

SH256 hash:

8a06fccb0a08f6019090f19d1ce470efa5359e969c5acb068a32abd90e8dae20

MD5 hash:

600b2599059c380a4f1b1ec9bb217a9d

SHA1 hash:

ae1236801a7133a4a7b4495af9cdeb93350fa03d

Link:

https://www.unpac.me/results/19483223-f010-4941-8a12-33ed63a00032/

SH256 hash:

26bca8f2df1f878d1cb11319e187371aedcce3181a258794fdf77c8d9c55cb03

MD5 hash:

b397a4cf70c804deadbba5f284cbce93

SHA1 hash:

a2a7a093c16cff14ea35b2819b600d328d104438

Detections:

INDICATOR_EXE_Packed_SmartAssembly

Link:

https://www.unpac.me/results/19483223-f010-4941-8a12-33ed63a00032/

Parent samples :

fca4e12e29cf37dcc23a48f671c5dd7f8f4d473bba7754091ca1287d2b124205
a775277953ea0daab3cbec4aa2b37c5e0052172c05f7d4d0e8c39894c58fabe0

SH256 hash:

fca4e12e29cf37dcc23a48f671c5dd7f8f4d473bba7754091ca1287d2b124205

MD5 hash:

cb8f38ee0a74699f0aa3fa77010bfa8d

SHA1 hash:

2679e89e995227a53db1c8e0ea109cf46f8f07e8

Detections:

INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438

Link:

https://www.unpac.me/results/19483223-f010-4941-8a12-33ed63a00032/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AgentTesla

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/fca4e12e29cf37dcc23a48f671c5dd7f8f4d473bba7754091ca1287d2b124205

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample