MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0411aa382c38d60eb36b370052e311dea63cbe722ef661873abe61729879be9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0411aa382c38d60eb36b370052e311dea63cbe722ef661873abe61729879be9f
SHA3-384 hash: 935eeef81de2b3a76b2ebd549bf6f889ad447f4a37d2d428144d36fd17b7b28fc15da7843c9e47dd870ad85a2cbd5631
SHA1 hash: cd9353eeb45921e62995fcebdac24f57171a49d2
MD5 hash: 5c60784056f6fc73ccde203892f7eabe
humanhash: football-monkey-item-grey
File name:S O A.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:690'688 bytes
First seen:2023-04-12 12:50:25 UTC
Last seen:2023-04-18 01:17:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:QeY+I0pW48+hNknKT7GJejOtysczjLdhys//HzrgML3OEfKvajdC8QiwfliadEIO:QP617GJrYvXLdhys3TrgMrOEff5C8QiH
Threatray 2'043 similar samples on MalwareBazaar
TLSH T1DFE47B2D2D5F4222E178A7718BE18460F7ED8153771BBE2B68D621C04B12AC6FCCD66D
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter cocaman
Tags:AgentTesla exe INVOICE

Intelligence

File Origin
# of uploads :
5
# of downloads :
244
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
S O A.exe
Verdict:
Malicious activity
Analysis date:
2023-04-12 12:56:16 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b68f672a-6f4a-4508-b05c-5204f82801ba

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/381792/
Detection(s):
Sanesecurity.Rogue.0hr.20230412-0332.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
floxif packed threat virus
Link:
https://www.filescan.io/uploads/6436a93719d967533f896b8a/reports/d1c044dd-1854-4cf9-97fe-bb15f54bec62/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/0411aa382c38d60eb36b370052e311dea63cbe722ef661873abe61729879be9f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5f566bf3-0e11-4384-a089-9ddc9e45bc1a
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1212660
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0411aa382c38d60eb36b370052e311dea63cbe722ef661873abe61729879be9f/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-04-12 01:56:52 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
11 of 36 (30.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aqi2uobmhdla5m3lg4affyyr32tdzptsf33gdbz2xzqxfgdzx2pq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0442d940427ea6e7f9d614bb83ca56d539bed99c4307b7a6f13c35d73c002ef6
AgentTesla
1d0a3d165801a8cc1afce2a96c47e613927f5e1e2dbb11ed4e896f8bb31a3322
AgentTesla
2477006ed8c89641b3bef2e81c0f018e812fb3242fe521814b3ef58cb00bea81
AgentTesla
5df3a5073fc1a14936a0227e2674ecdc580c804e117463a40b417a54334e04cc
AgentTesla
7c612196b40b14c3431c91dff9e9128ed6fa1261afa9a531fd834be8da0cb808
AgentTesla
a00b290cc12ad7042a413db8e0d0a54d13e307793aa9e0f60797de992c91dc7a
AgentTesla
+ 2'033 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230412-p3g8xscd38/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
AgentTesla
Unpacked files
SH256 hash:
c84179b3164938b78c7f90ae96dbd304f9800c71773c44fceb1f944d1d934f51
MD5 hash:
719d5aae9de94f91924ecf996eb85579
SHA1 hash:
7dcf02751804f881083f6656bf147d5e85e1893a
Link:
https://www.unpac.me/results/be6e2158-36b2-4ded-9a80-37e233582750/
SH256 hash:
cfa42d4c45e2d817add21e3f0589a60a927f048be5a8d4d35cf983a6e2bd4549
MD5 hash:
e8c541dd01f614cc529007b8c5461edb
SHA1 hash:
7349891870df832a681909f9d4f095b339ccb0f3
Link:
https://www.unpac.me/results/be6e2158-36b2-4ded-9a80-37e233582750/
Parent samples :
ce095951b07d0d736318adaa328b7e063b4bc4ecc1253cc539962ce858aa5a94
727483aa7ea49c89972f8c29aab76358cc5bac132ef55b2ea50d33740be77bf7
fd1bdc40d858f9c6ee3ef472520b28bfc996d7721828289c0a5be6cd71d0dd4e
20fbc3104600a6465f708b17466f189c03c96a1dbe415c19445a497096169a10
2be390bb4e60319e1878d001c545f5e6122b2dd0f7bfacdefd26edd56ed0dff7
SH256 hash:
ea8d4c91ec5bba5e1db6c17730d7ba5cdbb5ff3c1a777f70c90e91ce599d9b5d
MD5 hash:
27f5124bf8f451bca8d8a15c73c4f521
SHA1 hash:
5fd557e109b8fd1c3b362b64f0ba9f1600c07211
Link:
https://www.unpac.me/results/be6e2158-36b2-4ded-9a80-37e233582750/
SH256 hash:
0411aa382c38d60eb36b370052e311dea63cbe722ef661873abe61729879be9f
MD5 hash:
5c60784056f6fc73ccde203892f7eabe
SHA1 hash:
cd9353eeb45921e62995fcebdac24f57171a49d2
Link:
https://www.unpac.me/results/be6e2158-36b2-4ded-9a80-37e233582750/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0411aa382c38/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/0411aa382c38d60eb36b370052e311dea63cbe722ef661873abe61729879be9f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 829be0011872ad64fa5a0320e337c4cf90c2a5def8d38ef7a37770ebc24a83ab

AgentTesla

Executable exe 0411aa382c38d60eb36b370052e311dea63cbe722ef661873abe61729879be9f

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 829be0011872ad64fa5a0320e337c4cf90c2a5def8d38ef7a37770ebc24a83ab
Cape
Cape
https://www.capesandbox.com/analysis/381792/
  
Dropped by
MD5 d2864fc90c7606ab9b171453c112f0d0

Comments