MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00972929b3e57240b86f2812aca237acff75e09d18a55bcf575d22a2beb5fc9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	00972929b3e57240b86f2812aca237acff75e09d18a55bcf575d22a2beb5fc9f
SHA3-384 hash:	4a62f1202cf6db6082f5c563b80a1628118ca14d2aa71b6ceda918eb4d8799130e15e33a13ffb7d44c1b90c637095d76
SHA1 hash:	d19dec7350843726ee78498b64a9e2fb338e6637
MD5 hash:	94f3fd2c4d7eb39f41b58277228f155f
humanhash:	whiskey-leopard-thirteen-twelve
File name:	DN-5690532-045676785.jpg.bat
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	830'464 bytes
First seen:	2023-12-19 13:48:16 UTC
Last seen:	2023-12-19 15:17:42 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	12288:HvRc7SGY/jZd6PM6tXSsoYo8JOAjY61CJ3cWAmot8WD8eUMP:ZYSGY9YM6oDYJJTjYNhcIf
Threatray	561 similar samples on MalwareBazaar
TLSH	T1E005D43C98BD2627A4B5EAA2DBD58823F120996F311E6D7598D3C355730AE4334C363E
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	malwarelabnet
Tags:	AgentTesla exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

304

Origin country :

CA

Vendor Threat Intelligence

CAPE Sandbox AgentTesla

Detection:

AgentTesla

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/468492/

ClamAV Detected

Detection(s):

Porcupine.Malware.58887.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

Reading critical registry keys

Stealing user critical data

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/65819f52b855eb3693e67d88/reports/61b59efd-adb3-4088-924e-c285cf13a327/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/00972929b3e57240b86f2812aca237acff75e09d18a55bcf575d22a2beb5fc9f

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Agent Tesla

Malware family:

Agent Tesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1be8dc46-cdca-452b-8692-a904f4969270

Joe Sandbox AgentTesla

Result

Threat name:

AgentTesla

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1364539

Signature

.NET source code contains potential unpacker

.NET source code contains very large strings

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/00972929b3e57240b86f2812aca237acff75e09d18a55bcf575d22a2beb5fc9f

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/00972929b3e57240b86f2812aca237acff75e09d18a55bcf575d22a2beb5fc9f/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-19 10:12:20 UTC

File Type:

PE (.Net Exe)

Extracted files:

12

AV detection:

17 of 23 (73.91%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=aclssknt4vzebodpfajkzirxvt7xlye5dcsvxt2xlurkfpvv7spq._file

Threatray agenttesla_v4 agenttesla

Verdict:

malicious

Label(s):

agenttesla_v4

Alert

Create hunting rule

agenttesla

Alert

Create hunting rule

Similar samples:

00972929b3e57240b86f2812aca237acff75e09d18a55bcf575d22a2beb5fc9f

AgentTesla

0a109b2fcbb4ceae58549963c3c7ba7444763b9c9536323e95d90116cd78f809

AgentTesla

325dd2427643da7867652e7258a35491b6f20f1ced54171472628521cb91f54f

AgentTesla

47009c672adb7afb15740b8a01913ed3f80e3e8cdb602fd49f79d7a500ef1e7b

AgentTesla

af05bc98f43fe36d326207744952acc1a11e122bab8c8c928aa8508d7f2c1b4c

AgentTesla

fb5a97acf9b392addd2c222672ee4d97b6d1a39e6877734db1cb012f6a356793

AgentTesla

+ 551 additional samples on MalwareBazaar

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231219-q4nb1abae8/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

UnpacMe AgentTeslaXorStringsNet MSIL_SUSP_OBFUSC_XorStringsNet INDICATOR_EXE_Packed_GEN01 INDICATOR_EXE_Packed_SmartAssembly

Unpacked files

SH256 hash:

d01f3dea3851602ba5a0586c60430d286adf6fcc7e17aab080601a66630606e5

MD5 hash:

579197d4f760148a9482d1ebde113259

SHA1 hash:

cf6924eb360c7e5a117323bebcb6ee02d2aec86d

Link:

https://www.unpac.me/results/3ce2f88e-68c8-4761-8409-92c76082b459/

SH256 hash:

a8767b649a67e799469a73fcf093d79dcd3f4a7c187b45c11639f8e67e89d2a4

MD5 hash:

1c995704e0c0c3de5db167ea14339e7c

SHA1 hash:

ae68a632ea3fb8066ae0111725faa5a42aa422fb

Detections:

AgentTeslaXorStringsNet

Alert

Create hunting rule

MSIL_SUSP_OBFUSC_XorStringsNet

Alert

Create hunting rule

INDICATOR_EXE_Packed_GEN01

Alert

Create hunting rule

Link:

https://www.unpac.me/results/3ce2f88e-68c8-4761-8409-92c76082b459/

Parent samples :

a8767b649a67e799469a73fcf093d79dcd3f4a7c187b45c11639f8e67e89d2a4
47009c672adb7afb15740b8a01913ed3f80e3e8cdb602fd49f79d7a500ef1e7b
00972929b3e57240b86f2812aca237acff75e09d18a55bcf575d22a2beb5fc9f
a2e82dda8b0b0cc7831f28e2174a990d479819b3eae7c57e360ed9e11c4effe8
fb5e0a41602403a20017973b3e0af1b742e32ecfbbf6f565b4ddc271e0c0350a
54bd2e31afb0fb4c86e21837884aecdd7b045986e2e6e942c0a835f62c73f6c6
57d916eab0857ac4c801805981105aa12540775ebd09f0abf53d8a8cde849c95
cab1e1538f9de2a9a663d7ceebc17a2cdc200fb2c09c5567ef9f273e5bcffdf6
18ac96e96cc73915037fba65ae3191c953c51485b4851a38de3cff90745530c2
a603f947d120ab48ee654acc6714eb647d3bdce3cdf9f9018de0aafdd2e2274f
755d262d3f1e444bdc34a6a4c536738bdba7e0b321bc6a7771ad059e1ce5d8ff
ee7a41725da2bdf69d892c1ac563b9d11b317ff6bdf8971937abafca74d33c62
02a409733c223599defec67dad21f76ae46821bc83e4d9726ee203870dcc3105
c18492bcd0a23388350bcf8e42727337b77b463fb83de661ad5e8dbe40ed98df
5c00d919e3895f872959d16c8bf210da4f9e20c01791a88d7a0f60b13a22c968
88750990adb66bcd3435e4920b626aaccd51c5c13d778e8e1bff5bd51813b3b0
06c2b1ff831a7ef951d16f8d66b3aeb8cf0e34ea7cf10cc97fafca3954d3941a
92d6b2ccfc3f6f350b4c5f989022abda28a982e9fe0bb4121ad4092802e1a758
945a7283148a1fb1d96ccdd8eb5d69245ed7ddc37c34a709c198e5ad1689f914
9ff7aefc37e4add2457417f35ba73e8c53a4f9ab7ced0656fec94ac8f5e35630
a672e3cd3a4f6227f4b5551a23f559baaa25f3ead5251e798bc05d563702395a
0707a94356aa1c072718ccc6a687b250a64d64d4dbd0bd2143b38dc5e6ea2bcd
7810ad9adf690135bdcc8cd581bf99aa986f4ee723b7ed38a1da2b3056379b31

SH256 hash:

84959aea5443bb07cc3fb7eb12b95b7e70188eef555ebd2e94aa80607a3fa747

MD5 hash:

1db63a62603bd3dd850a23544c682003

SHA1 hash:

a87850115b40e22cb113cca1a1cf3f14fe460729

Link:

https://www.unpac.me/results/3ce2f88e-68c8-4761-8409-92c76082b459/

SH256 hash:

c681e39199e58b59eadda0b0fcf86b9fc2e6c43cb2ec392bc05627245b2148e4

MD5 hash:

44c9c77691c640a1c57dc3b82db6cf70

SHA1 hash:

4da3e3d560a75b61a381ed657e34b0ff89548568

Detections:

INDICATOR_EXE_Packed_SmartAssembly

Alert

Create hunting rule

Link:

https://www.unpac.me/results/3ce2f88e-68c8-4761-8409-92c76082b459/

Parent samples :

ada28dc16f1eb7d03ad145b01c1525e832d18bcd8a179dd68c1f5c4313b5853f
9496ea650a182fc8c1b87b205c226d44b7271186b473b156cfb727c2e81dca0a
2fefc7f1b4dec38932b815ef1192a4343c4face356016de5ede1c17958950975
be69955e99c6aec10c257ba0211df9cce2fd5af533a8932ba447b1450aa35699
59d1135fc573e663c3c92460520c6ac49ef035d3ad789cf69708cc6c6409a9bf
bb0563d0a398d0501bda4848f662f494dc8807b2ca7e81fd733d38e1145f1efc
ba33d177c1fbc1f4f44ae77af00eb377e9196b2f9f1556e94fd82b942883be13
9996fd83b852a172c456594e49d2a13d94b0c8d55a9a2d28e5658853ed819b28
c5cd096e51840ab5ceb8a29c7efedee7ae3f16562bdd4779b5b1bd44dfc784e4
128b915c058609131a3ae2ae25b26aea06b51a0001bb9b9794b9cf401f16668c
961501b7f2e2ba7d255fc9cc4de8dfd0697dd2265c2e4e316f92854166614c31
5c7c411ea48976a55a30558e1ce6147a7f28b6b99d84083e1f01de1db86bb588
9dd7786a5c103076ba73cce2e2a3dad65a6a76684c781a86d924cddf9bffc8b3
a3980c5f653e99fe53dc88f60a9ca1b4954b8cee932085ea57b1f46b9c7ab4c1
30f5366a61da542dd959a186cf9ae3cbc13efa1d66fcb67631b62cfd8ee52612
9feeb14ac128b73d9c6eaaea8c91272ed93a1780c126b6ca90ed077f1185484a
ea93863c147402b54407c3a1eff90043b55e76a08aa3ff4a8823469dd4d9def5
46295ce76105598ad1d887f772d13391523cf76347b3ce1f8be1db96053c278c
9704e443a68009427028c22fdb39eb3e28a32709d42358b1df4c95d16a4112fe
ac44b7c74193bdc699761d10f631bde2dd81b7f4d23d57f6cd240c62a9b26331
6464a6492dd967af2d0582451a3574b456699f0337cc6b10c088988078fed79f
4c3c1031279a42eb5955cccfd5a006235cd27b909503d10ad4eb1c10dc5cebfe
e404945ee6da74e3dda8a92dbb0e7e163c46a48c84aa0a291456a0f66a5030fa
5336c951ff27b8609dab0bcde98c674d54e972eafc5514039d0a893fdd52a965
b25ebc1b52d81dfb1cf844c3b87d65c0a307589b2775c12aa7c7c2ebcf74fcd1
6bffe8588990f845c6eeafbdd359e2355dbcd68de8b0605175935886857970bb
0390ab5a06e04c8c38776aeeea11fd0352230d049be1defb139e71e8906114ba
3e43fe5dce47c5a3115320ac38040f4b6367e58356a06810ca638579da1bf3d1
fccac8700366b9cf48eafc5c012a1616534d26fc6501d4014e56a0619d5d0db4
b965df83cfeec960e1372166cd73d936ebfb3be2986db0bf953bf2b67b5209ce
3d537a7796fa465cdff1388141e37df9ff689007f024808b90381640f99b9b7d
9cf514b4555e47eccf07148c0e961250d108d04d8187a4aa224629f7a0961142
8737b9c5969931c61500427c301c40e635acec433bd4450e1dca9f202e97fb6f
6819d0ef008f17b3bffc407cbc8e37c43eabfdc39bdb10029afb535f542e4d86
7948315565e8321056661c7aabdeb10e01ca73d2425a6f6bd17593a0ffb484ef
531ba82cdd6f8cba501fd8c5160ec637c2193ce69c455dd8e591da083f2c80da
509f9d3065054df28846986ba9a1190361092f3bad865d77ef2ff10d32151ad2
abd4a743c4aa8fb625f1af14edc51606fc1b8e1a15396d9db706c1fd3cf41395
4a0a2c6bf6a863c1c56fb7b6657fd8cd60369e03fb40d8634eb5ee37d8575390
5721a2c6e2c0a577828b9e4b3690a18a7df63e541aeba65781464c1f73e8da91
24ba94ab2486ed9bbac37e3fb3508b6bb38ec8bafe1c0816719351e0790a21f4
e5ba53de1a80eda27337da32ad9bf522473c542fc42a434fff3fc843cbdf88ed
d2312c82b0ef97a5bfcf73173a4b72a720c2194278d6a7815091e4f4727e6a61
fe708d845a9c3e6d3338b2a146a4a5e68fe05d448b72a63bd60f4b431b243d9f
56cd0e12747b872def87829710c32165fc42e34ed351872e1750fbc13a8c31a0
93c052934438599045e6d9a3177f5d7d57960cad17070bc74444c1e4818bb81b
3de39937dbba16980b665dcf03505af8bd11a77a9f09d8e5ca69837932a9340e
b2617dccd3165177226a7c23effd6dd4e51e0c06c7ad57818ef1461ecaaa13e0
4f8ef9616b1237912967776aff09a8b8fea96837f78787911ce7405ecb4b001d
33208d34b4f679b8ec036d5be12f4d2ca960dbbd8af46b20247d5df93f1f63a5
3ae22f99bd5e1772eb6f9abb1d127c8682b5847b6e7e062d843ef236db85e828
94afbf76b9c59a5e2ae4bc864a78c41f92602c5b37e6771eb29864344b69dbce
b091bf4326241b1053f88a1a47618fee3f87ccdce873a9bb79e653670b7e4948
8d693225be9e1f824c20f3bc2f71a9c21e87a2b32bca274580b7abad75ecacbb
d02530a2bac21b47a1ecaafc185ddb11680c9a90d0fcb2c52b7b081b952f1cd2
01dbf52c9a79ce268fa7b5ab876ab6c8a8e6d5d5de70ccfacd11ca169e83908a
5c11be9fa69ed199fb4004a1fb7cf649d4f7e469b43c7b5f73f4867cecf89d18
7f2fea83dd18d529a6a6440334240fd6ea6cb4a84d4bfe1ab3213c894a7a51d0
0eed254ba5c7e7cc2b6ac08be4b1a450d453b58ed58d5b23caed7fb0db89961a
9dba8d99de990b1900e024e45a32d8ed2ffe06018ea422a92eb4a9cca56144e4
2b55e6baa2cf6110fb403cdf32cf7b9c06684e06a53a417b9f0bab73fb9c6747
71cabc7f66e840c073f576ee3051b7e4eb355bc28065a10eb06e5ec737d08221
61c11d170ceb320bafd7872824de7ce33d10fdbb5ef585e67487f9afcde5e207
4e77677a9a29e465f030c9a9695533c8dbde964ecc66585a0b9f26a1548ad3ff
0172a0a250dca4e77360389ca9a6ee4dec2f306bd056265c9a42de7af49481f4
cf672b77bf6d5faee34f9ebaca90fef0222b422db31d4464ec73126a15736c3d
00972929b3e57240b86f2812aca237acff75e09d18a55bcf575d22a2beb5fc9f
8e57e2bf33cb22ceaf6596ce060680e8efa099bdaaafc2383b1d31b24b0fca58
6d306743daac37b3fcc6276d1e507f504833ffb8db0839808c016a339a64cf85
7bacfc4148055cac9beba5517630e42a46ca8689bc8e6fd1bb25831e43e58582
e28cbe3c81e959dd96ca36cbf3585b4523ce4d75c989ffc16d756f71b3d2fe54
2b6f9aaa250051acb504eb782e963ef4bffca581d26d7c632b405f130ee5e09b
2b99095636ec250358f5abd47474a374de96f743fc2fadb89642401301e6b670
ef8e672ff4f30d2630ddebcf804c67d572e9979c949e4803654572479f486db0
e50bfa53e75f7c54582c2609f3c59db91bb47590a43a49e95e5458a6ae97ad4b
d6aa67de9b98880b2d666debd047112535c8527642220a81b72d6246b1eff210
0c263290cd7f3c225d5f7b2ba488ac5d9927b03411c566fd81b73bbee827c46c
0ca7d41fee3a2830bf3c46fad06e838fa2f3a362a3f62f58f1b3f0176146ddc3
937937444fbc2f971d32996dc728c166315195b25b2c0aa4befbef762b93ea35
46a870926fb693596e4fea1ff6ed4bd228d8cc63a9e285997ded48b1484ab3f5
8736f4327bdd2098d35ca3ed5c2733f3a066a434804b846277047ef097e09c85
68539ce65162c2526ee390f706b68e249e05e0453f2e5138dd77a9d5aaa9b54c
1e0ec921f531219f110e8bf1e1e5b5d757119ea7e2f1d885bfa234007548c95d
6474b902f837575873e3b356ef0939eedccf0cad4b07a82fc5b7aa80d3b46339
d9c3810761942c6191a8e2dfb22b2178d6970bf474a908a4af1bc80b3022a774
4dbdafb1f38d8d8f55f611e7e6985b3975658a8b0b652d80c432eff73812e21d
169ad5c33acf7a4aae70046eb2ac4e8f60c62c236065c616277b827ea4ec00f9
79658843a0028941539f3b437a8d262c78b15e6e58f4b1f7b96bf357b06fa84f
326f39b2d29896b3748625b4bab991da83ce7583b35dc0ed984455c77f24057b
18f9d778efc5dcb90c7ae7ccaacdfd8b9041295447759c1811e99a5d0a48dcda
a9ed7edf5b5cecaecdf126bafc6c85d3ca918363d874f3c33afc07131bc43c4d
26f693ee7807e9a341eb9936519194f587d1bd2998fdb734d36cd62b9a46b8b1
d34e493e8e0dfa5e9a04ded3565e2ed4d60473148e63aeb3fca9a7f62dc90900
70369453cd6e8481ce8f2fc4fa4074fb998a27ff6f91bce6caeab0ecac36493b
781fecd030f2f437a89dcf726a45e3eed218043316b35e80770a20a6f4bb62e4
c569fe7d3ccb9bf36356f829d5ab7de3ba4261d3beaffef1e690d8d197919c71
221df9cb593d75416b887497288cdd49ed654c164f1a752671301228a97e2282
97a3313357020aa0cda6addb7bd2015cc52f67dcde4c75f4d89f9f4d76f17b04
3e90bab5c79be10c283f3752091122910f7c5b9f35428a37eb0250d244d01f94

SH256 hash:

00972929b3e57240b86f2812aca237acff75e09d18a55bcf575d22a2beb5fc9f

MD5 hash:

94f3fd2c4d7eb39f41b58277228f155f

SHA1 hash:

d19dec7350843726ee78498b64a9e2fb338e6637

Link:

https://www.unpac.me/results/3ce2f88e-68c8-4761-8409-92c76082b459/

VMRay AgentTesla.v4

Malware family:

AgentTesla.v4

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/00972929b3e5/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.93

Link:

https://yomi.yoroi.company/submissions/00972929b3e57240b86f2812aca237acff75e09d18a55bcf575d22a2beb5fc9f

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/468492/