MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05238efd964125503399743df334ea2ae9bdc4871c2ae1537b49874c6976f951. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 15

Intelligence 15 IOCs YARA 1 File information Comments

SHA256 hash:	05238efd964125503399743df334ea2ae9bdc4871c2ae1537b49874c6976f951
SHA3-384 hash:	8c0dac6d6246c5bfb5ea037f0c60a2fafde4a3655714b051a79a066ebe7e00cf40cb4c58c55b2bea39ab6c0e3ecedfec
SHA1 hash:	5d56021321c41b48487d9aa087455df3d599f65d
MD5 hash:	793a34cd320611ea29df625c67d5094d
humanhash:	winter-two-moon-foxtrot
File name:	202105-USD122986.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	329'422 bytes
First seen:	2023-02-15 13:41:25 UTC
Last seen:	2023-02-15 15:43:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep	6144:vYa6keWh6CR4vkiF4bw2M93qt/5bkfVmUPgXFCZvX7HYH32y2oo2P0:vYaeWh6EViuMZUZYQqgXFWTYBN10
Threatray	26'375 similar samples on MalwareBazaar
TLSH	T1336423289766C593C8134A311C38514BA3E9BE21B5A2D34733A11B9F6D63B50BF1E7F2
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

196

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

202105-USD122986.exe

Verdict:

Malicious activity

Analysis date:

2023-02-15 13:46:07 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f886cec2-e1d7-4a8b-82cd-41db7c3b1881

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/366622/

Detection(s):

Sanesecurity.Rogue.0hr.20230215-1234.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% directory

Creating a window

Creating a process from a recently created file

Using the Windows Management Instrumentation requests

Reading critical registry keys

DNS request

Sending a custom TCP request

Unauthorized injection to a recently created process by context flags manipulation

Stealing user critical data

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/70371/overview

Behaviour

MalwareBazaar

Verdict:

Suspicious

Threat level:

5/10

Confidence:

83%

Tags:

overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/63ece12e54f64beb90111019/reports/969615a5-1574-41ba-be01-6d40eb7cc530/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/05238efd964125503399743df334ea2ae9bdc4871c2ae1537b49874c6976f951

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8fb91888-8de7-47b9-9b9a-d990e6b9120f

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1175737

Behaviour

Behavior Graph:

n/a

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/05238efd964125503399743df334ea2ae9bdc4871c2ae1537b49874c6976f951/

Threat name:

Win32.Trojan.Casdet

Status:

Malicious

First seen:

2023-02-15 10:53:50 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 25 (88.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=aury57mwiesvam4zoq67gnhkflu33rehdqvocu33jgduy2lw7fiq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

3191fe463f8c9a91ccf9ed9a81daef803f9c184fcb093b24ffafa1f2f318eb64

AgentTesla

3652bafc6040261b1ee34d360ca1f2a28277a258e9ed843ff0b8c846df58f8ca

AgentTesla

5a4d6959bab110d8c072b3c901e22463388ffb87c673243da8cd5c4064ab7ec6

AgentTesla

7ea54a151d7340d97ccc3d53dbf82900b2205f0df10b0571a12501ecaad5359d

AgentTesla

d548bfcde55e09b8314b273b6fc1eff79563961b965cb83a763f4bb1b6c424ac

AgentTesla

d6b1eec8bc20f67e635ce3b33938775757508384db07f1df35e4d09959f8cb6c

AgentTesla

ed1dd3f734ad29aaa1da6ada3823d8537704310f257e44524ea08d4c5f81ff3e

AgentTesla

f2a4e636a95c5a934cd6a27d9e91fd83482db7b2e94a3f61ed6035f8feea19a3

AgentTesla

f873aff34af07e0be6364498ef313f9e21454ba6fcab0a24c5da2a438de2770c

AgentTesla

+ 26'365 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230215-qzpn9sbg4t/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

94d341df30a3c6ce139f083130367e95fe8013493eb24492d45112229a10bb0d

MD5 hash:

679b96b9c6239afa9e77857541699ee5

SHA1 hash:

9460f7df2b036ab6be7eca0fb7b22aeeb76c033c

Link:

https://www.unpac.me/results/9494015e-6cfd-4c7c-9942-4bc39aac059b/

Parent samples :

720be830d608d17de8f83bde1fd7a90db5bd75ebad8fbe10d60ea4bd1fa9f760
1e78015efee2b6e94749afd35ae539a88520ff959e06ca20683c6d0d7218b4c2
22c4b05bcf26647a2464500666ec31c235599a73765d4cd3452721eb2cf2b020
0b4d7a81cb8f89e34562cd756540d3dd62176c0fa829d7dba9db2c727b92aef0
b017455b50865cfdd26486b8c6d8348294ee6fba27ea97eb2d94e6a56b7397b5
edc2598baa07918d489c7642acc5d1051506ca818323627769d3b4d6f218eacb

SH256 hash:

e97bf1fbf4769710bfea91fb6674f141d56e44319ac9dca00429e9acf6c5b428

MD5 hash:

2b36d5616a808c70033e99666c0e66d5

SHA1 hash:

7f9848432d787066452ebb5febc8b3d875963499

Link:

https://www.unpac.me/results/9494015e-6cfd-4c7c-9942-4bc39aac059b/

SH256 hash:

cafd1384622ba66de182cfd57a56007562794e94e7d5a373a963b9b9550e17e6

MD5 hash:

5e4065ec91c9b618b178bab775f88827

SHA1 hash:

b5078157040f7eda23ce32ce1d161cc9ca41662c

Link:

https://www.unpac.me/results/9494015e-6cfd-4c7c-9942-4bc39aac059b/

SH256 hash:

05238efd964125503399743df334ea2ae9bdc4871c2ae1537b49874c6976f951

MD5 hash:

793a34cd320611ea29df625c67d5094d

SHA1 hash:

5d56021321c41b48487d9aa087455df3d599f65d

Link:

https://www.unpac.me/results/9494015e-6cfd-4c7c-9942-4bc39aac059b/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/05238efd9641/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/05238efd964125503399743df334ea2ae9bdc4871c2ae1537b49874c6976f951

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.