MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0994d529e4126e53aa48caf2276a84cdaa58a882635069ff9ef3ec16e262a8b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0994d529e4126e53aa48caf2276a84cdaa58a882635069ff9ef3ec16e262a8b6
SHA3-384 hash: 053a3869297dfbf3bab86f9f1640dd70b5f28ad1303b996cfce0e075e39b07037f77617894a13146c055ef6a38932708
SHA1 hash: 5c72a21f0a8b0a2966160fafa18ce09dccc257da
MD5 hash: 2f0c450508549a0bdc288f2d6e04991e
humanhash: oxygen-thirteen-louisiana-arkansas
File name:proforma Invoice.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:824'320 bytes
First seen:2023-02-24 10:07:47 UTC
Last seen:2023-02-24 11:28:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:7UhRuQUartnHDuliDXxLgVYq749fetXLhfMHjOz1GNQ82Rjvl8mQVo7nxPI24Zu:7UpaiNaYq7492KCY09RK24g
Threatray 873 similar samples on MalwareBazaar
TLSH T1E305AD88E674532BDFDBBD6A7604318F19E0B98137119BBDE3D529B0E204A75E2C44EC
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 3096d0f0f0d49630 (5 x AgentTesla, 5 x SnakeKeylogger, 1 x Formbook)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
218
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
proforma Invoice.exe
Verdict:
Malicious activity
Analysis date:
2023-02-24 10:08:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5b6bff42-c54a-463b-a4bb-172a9145558e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/369381/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
packed
Link:
https://www.filescan.io/uploads/63f88c84663463c1cb677af3/reports/91d8de59-e114-4c39-af5f-01927470fe1d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/0994d529e4126e53aa48caf2276a84cdaa58a882635069ff9ef3ec16e262a8b6
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/98072d4c-9e5e-4733-96f3-4d32267e137f
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1181761
Signature
Contains functionality to register a low level keyboard hook
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 814592 Sample: proforma Invoice.exe Startdate: 24/02/2023 Architecture: WINDOWS Score: 100 45 Snort IDS alert for network traffic 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 Yara detected zgRAT 2->49 51 7 other signatures 2->51 6 MpZZj.exe 3 2->6         started        9 proforma Invoice.exe 3 2->9         started        12 MpZZj.exe 2 2->12         started        process3 file4 53 Multi AV Scanner detection for dropped file 6->53 55 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->55 57 May check the online IP address of the machine 6->57 61 2 other signatures 6->61 14 MpZZj.exe 14 2 6->14         started        18 MpZZj.exe 6->18         started        29 C:\Users\user\...\proforma Invoice.exe.log, ASCII 9->29 dropped 59 Injects a PE file into a foreign processes 9->59 20 proforma Invoice.exe 17 5 9->20         started        23 MpZZj.exe 12->23         started        signatures5 process6 dnsIp7 31 208.91.199.223, 49702, 49703, 587 PUBLIC-DOMAIN-REGISTRYUS United States 14->31 33 173.231.16.76, 443, 49700 WEBNXUS United States 14->33 39 2 other IPs or domains 14->39 35 api4.ipify.org 104.237.62.211, 443, 49698 WEBNXUS United States 20->35 41 3 other IPs or domains 20->41 25 C:\Users\user\AppData\Roaming\...\MpZZj.exe, PE32 20->25 dropped 27 C:\Users\user\...\MpZZj.exe:Zone.Identifier, ASCII 20->27 dropped 63 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 20->63 65 Tries to steal Mail credentials (via file / registry access) 20->65 67 Hides that the sample has been downloaded from the Internet (zone.identifier) 20->67 37 64.185.227.155, 443, 49701 WEBNXUS United States 23->37 43 2 other IPs or domains 23->43 69 Tries to harvest and steal browser information (history, passwords, etc) 23->69 71 Installs a global keyboard hook 23->71 file8 signatures9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0994d529e4126e53aa48caf2276a84cdaa58a882635069ff9ef3ec16e262a8b6/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-02-24 10:08:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
19 of 25 (76.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bgknkkpecjxfhksizlzco2uezwvfrkecmnigt7466pwbnytcvc3a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1307aabd4251736619cc78c16a7b35bd5d35d68e03c1d6fe48b250b2a17c3f16
AgentTesla
135cbc54b63c8ec17f8174791d5fdfce239e587a319a335d4c22ef7e7ec225d0
AgentTesla
175b18fc4d1ce73099a94c25d5fee0af5704e47b37803137368bdf416fc8a364
AgentTesla
5cc899a8dd9072ce72a49004c5b9f7cc074e4e7c4088fa89b25767182976e31e
AgentTesla
8f81fd0cd66548518e82ab4238cf83a55989de7b1ab9099ef43892d0272b41e5
AgentTesla
b7edcf412d229e488db5a92975a1b2398f4bc4e7dc0317f9e226b706140994f2
AgentTesla
f372f32242ba5521234305f8d8cb0f314b89be5417f875e9f2789348fab3d3c1
AgentTesla
+ 863 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230224-l58bcach2y/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
0f523bb97d792e427dc1d2babc691221def301288310098b7145d083f19e4e7c
MD5 hash:
b959fd775c3452b9eb6eea6989077d70
SHA1 hash:
c50ff815c250d0faf20682af3637556ba43bee62
Link:
https://www.unpac.me/results/55d357ac-0e9c-4626-8477-bf9c7c44e95b/
SH256 hash:
c74c0ab19ea6e5648df369d92dd5228ae4ae4bdb39b56642c750fa1e87aec320
MD5 hash:
2cececc74fa890cba68257dc18816004
SHA1 hash:
c3318fb4463d41abc05613e3fe100fcad1efbf00
Link:
https://www.unpac.me/results/55d357ac-0e9c-4626-8477-bf9c7c44e95b/
SH256 hash:
d06df7395d561e198f9b7c5481567116ff2e4c2e84437c018d2a2c8ea6c4ca37
MD5 hash:
0fb6061f7d37424fb9e6d0e76b019c19
SHA1 hash:
98a64bf7b459f032d6ec5793003bf61b5ae1dd74
Link:
https://www.unpac.me/results/55d357ac-0e9c-4626-8477-bf9c7c44e95b/
Parent samples :
495607b1aef01bf7dfb64b5cb16a8fc0f161c2923627d71c69de97328f8eca3f
2434aa78b46a3afc98fa6e888c3eb56278ba52b0ff800e7e875af9c2e7f9011a
SH256 hash:
dea2369b7d4c0bbad43ececcf9ba24cc7dc8e46c3de236b154cb9d5af0cbf5be
MD5 hash:
6336ffa05034538ea24a4bbd92249135
SHA1 hash:
7641540073babd9c68fd35144475bbeaaf637904
Link:
https://www.unpac.me/results/55d357ac-0e9c-4626-8477-bf9c7c44e95b/
SH256 hash:
d53f525a821c6d8a976b246a01b0d812d25717954b85ccb8e721b0ffb3b7c165
MD5 hash:
90f99fe5c69651e4aff2d0be1a970b53
SHA1 hash:
55188e136287248dae1bbb66aabbd4949bb6ab82
Link:
https://www.unpac.me/results/55d357ac-0e9c-4626-8477-bf9c7c44e95b/
SH256 hash:
0994d529e4126e53aa48caf2276a84cdaa58a882635069ff9ef3ec16e262a8b6
MD5 hash:
2f0c450508549a0bdc288f2d6e04991e
SHA1 hash:
5c72a21f0a8b0a2966160fafa18ce09dccc257da
Link:
https://www.unpac.me/results/55d357ac-0e9c-4626-8477-bf9c7c44e95b/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0994d529e412/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/0994d529e4126e53aa48caf2276a84cdaa58a882635069ff9ef3ec16e262a8b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 0994d529e4126e53aa48caf2276a84cdaa58a882635069ff9ef3ec16e262a8b6

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/369381/

Comments