MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0aea55a753fc5e090556cab151517684fc4526f2fdf65523abea2853ad11ba3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0aea55a753fc5e090556cab151517684fc4526f2fdf65523abea2853ad11ba3c
SHA3-384 hash: 6b2bd78da771b57d6c11bb363085d415df6771a1da6dbfa19a74e06b6fc2e0fcd3e42471f6fbd39be394024d83ae1c6a
SHA1 hash: b27a34429472a58c9a84d11b124008efbce5f777
MD5 hash: c1ab6de5fc136f64db5f5c8227b50a2d
humanhash: vegan-ten-bacon-ack
File name:z1MT103SWIFTCOPY.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:591'872 bytes
First seen:2023-07-04 11:58:33 UTC
Last seen:2023-07-04 12:04:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:pm+tks6hSeClNDZiDZ9mhGMsIrDik5P8J/20pVZipvb:nKCFNDZefpMsCeIPI/HI
Threatray 390 similar samples on MalwareBazaar
TLSH T142C4593C1CBC5E22C034D2B68FE5C461F554C6EB32A24F7667C7A6A5461E9022ACBD3D
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter FXOLabs
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
281
Origin country :
BR BR
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
z1MT103SWIFTCOPY.exe
Verdict:
Malicious activity
Analysis date:
2023-07-04 11:59:43 UTC
Tags:
rat agenttesla
Link:
https://app.any.run/tasks/b2ab1eb8-064b-4a4f-85c5-eafd2d8be0ad

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/406465/
Detection(s):
SecuriteInfo.com.Trojan.Siggen21.4469.30992.32691.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Restart of the analyzed sample
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook packed
Link:
https://www.filescan.io/uploads/64a4098a204315fbc16cb370/reports/c3fc0671-303d-4d58-b022-1591849ff903/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/0aea55a753fc5e090556cab151517684fc4526f2fdf65523abea2853ad11ba3c
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/80d64e81-5d97-420c-b672-09076c293ece
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1266558
Signature
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1266558 Sample: z1MT103SWIFTCOPY.exe Startdate: 04/07/2023 Architecture: WINDOWS Score: 100 53 Sigma detected: Scheduled temp file as task from temp location 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 Yara detected AgentTesla 2->57 59 3 other signatures 2->59 7 z1MT103SWIFTCOPY.exe 7 2->7         started        11 TgtDQhU.exe 5 2->11         started        process3 file4 33 C:\Users\user\AppData\Roaming\TgtDQhU.exe, PE32 7->33 dropped 35 C:\Users\user\...\TgtDQhU.exe:Zone.Identifier, ASCII 7->35 dropped 37 C:\Users\user\AppData\Local\...\tmpEB27.tmp, XML 7->37 dropped 39 C:\Users\user\...\z1MT103SWIFTCOPY.exe.log, ASCII 7->39 dropped 61 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->61 63 May check the online IP address of the machine 7->63 65 Uses schtasks.exe or at.exe to add and modify task schedules 7->65 67 Adds a directory exclusion to Windows Defender 7->67 13 z1MT103SWIFTCOPY.exe 15 7 7->13         started        17 powershell.exe 21 7->17         started        19 schtasks.exe 1 7->19         started        21 z1MT103SWIFTCOPY.exe 7->21         started        69 Multi AV Scanner detection for dropped file 11->69 71 Machine Learning detection for dropped file 11->71 73 Injects a PE file into a foreign processes 11->73 23 TgtDQhU.exe 11->23         started        25 schtasks.exe 1 11->25         started        signatures5 process6 dnsIp7 41 api.ipify.org 13->41 43 smtp.yandex.ru 77.88.21.158, 49691, 49692, 49697 YANDEXRU Russian Federation 13->43 51 2 other IPs or domains 13->51 75 Installs a global keyboard hook 13->75 27 conhost.exe 17->27         started        29 conhost.exe 19->29         started        45 192.168.2.1 unknown unknown 23->45 47 smtp.yandex.com 23->47 49 api.ipify.org 23->49 77 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 23->77 79 Tries to steal Mail credentials (via file / registry access) 23->79 81 Tries to harvest and steal browser information (history, passwords, etc) 23->81 31 conhost.exe 25->31         started        signatures8 83 May check the online IP address of the machine 41->83 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0aea55a753fc5e090556cab151517684fc4526f2fdf65523abea2853ad11ba3c/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-07-04 05:51:51 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
20 of 24 (83.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=blvflj2t7rpasbkwzkyvculwqt6ekjxs7x3fki5l5iufhlirxi6a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
03659d0acded7fe7db7daf0c7179d37e20cf38c5db6d5f2942bdcc2236cd497f
AgentTesla
3128342e14d0e3fdf92828d146cc86bc6f52520cd792b043f72e20eddb022e10
AgentTesla
6016b69e0267c1d95bdc8d1b685bedd1c0bef182fd197e3ee6f1753b8ba59eea
AgentTesla
7a4d39a7259028f1b42a0eff7414a273057dc2b880108d3152c5b20e02c6a407
AgentTesla
a74174da27ad7415025fd5f70ec71f0b9d87ec0b3227b7bc7355cc0fe82269e1
AgentTesla
b79d3384f353bf024148b984f6d96e272c30b7547a00fb5d6f05524dbcc435a8
AgentTesla
d60d94a1edcdab800f81abe6f72248469547a1b55f89cd872acda4cc6d7dee61
AgentTesla
d9ad2df08f75b265cb1865f6f3ba322488b69ab7fa1ce94ca509b27ec1c10129
AgentTesla
e81901a970e6242560a0a44bc37bfa54a19174920f1f1ea032aeecc2008f2884
AgentTesla
f4d6855474eaf9cf34a5f7b168b05bf88f174935f57104378d3bc5ac0db64430
AgentTesla
+ 380 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230704-n5qseacc95/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
SH256 hash:
274c9d689df9ab2fe033f32903e2d741850b412f8060b0e3b7a3a9cf9a676b48
MD5 hash:
d2474aad643d68351b0048f3f2cb2251
SHA1 hash:
6b867a2d09a868969ca47dfe91e273a812ebd8ac
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
Parent samples :
71626f4c825903dc56b7df19096cf84ae800ce19aa6e02f23d72fe847eb3cec1
d3fa8bd6b585950b90a820e54ce4b98e306dba962498f7f098ebd811dfdc735f
0aea55a753fc5e090556cab151517684fc4526f2fdf65523abea2853ad11ba3c
7f8a95173e17256698324886bb138b7936b9e8c5b9ab8fffbfe01080f02f286c
SH256 hash:
7ded460209d15ff84b3542b5cf73a5faf1c1bff6eccbdd3234721616e66c46c7
MD5 hash:
1a373fc46c1f036b65ef05be30204ef9
SHA1 hash:
5742e348c205d1c463910c5b226a21d6738ba314
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
SH256 hash:
973512f00ba81a790d2351f286c79dfea92692c9f7cd724e22ab11ff282f8130
MD5 hash:
3794c5f7b240e4184d6ea90c5bdd9ec6
SHA1 hash:
26b9c4a753779b4994fe38c16dfe70b07efd3e0d
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
SH256 hash:
274c9d689df9ab2fe033f32903e2d741850b412f8060b0e3b7a3a9cf9a676b48
MD5 hash:
d2474aad643d68351b0048f3f2cb2251
SHA1 hash:
6b867a2d09a868969ca47dfe91e273a812ebd8ac
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
Parent samples :
71626f4c825903dc56b7df19096cf84ae800ce19aa6e02f23d72fe847eb3cec1
d3fa8bd6b585950b90a820e54ce4b98e306dba962498f7f098ebd811dfdc735f
0aea55a753fc5e090556cab151517684fc4526f2fdf65523abea2853ad11ba3c
7f8a95173e17256698324886bb138b7936b9e8c5b9ab8fffbfe01080f02f286c
SH256 hash:
7ded460209d15ff84b3542b5cf73a5faf1c1bff6eccbdd3234721616e66c46c7
MD5 hash:
1a373fc46c1f036b65ef05be30204ef9
SHA1 hash:
5742e348c205d1c463910c5b226a21d6738ba314
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
SH256 hash:
973512f00ba81a790d2351f286c79dfea92692c9f7cd724e22ab11ff282f8130
MD5 hash:
3794c5f7b240e4184d6ea90c5bdd9ec6
SHA1 hash:
26b9c4a753779b4994fe38c16dfe70b07efd3e0d
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
SH256 hash:
274c9d689df9ab2fe033f32903e2d741850b412f8060b0e3b7a3a9cf9a676b48
MD5 hash:
d2474aad643d68351b0048f3f2cb2251
SHA1 hash:
6b867a2d09a868969ca47dfe91e273a812ebd8ac
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
Parent samples :
71626f4c825903dc56b7df19096cf84ae800ce19aa6e02f23d72fe847eb3cec1
d3fa8bd6b585950b90a820e54ce4b98e306dba962498f7f098ebd811dfdc735f
0aea55a753fc5e090556cab151517684fc4526f2fdf65523abea2853ad11ba3c
7f8a95173e17256698324886bb138b7936b9e8c5b9ab8fffbfe01080f02f286c
SH256 hash:
274c9d689df9ab2fe033f32903e2d741850b412f8060b0e3b7a3a9cf9a676b48
MD5 hash:
d2474aad643d68351b0048f3f2cb2251
SHA1 hash:
6b867a2d09a868969ca47dfe91e273a812ebd8ac
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
Parent samples :
71626f4c825903dc56b7df19096cf84ae800ce19aa6e02f23d72fe847eb3cec1
d3fa8bd6b585950b90a820e54ce4b98e306dba962498f7f098ebd811dfdc735f
0aea55a753fc5e090556cab151517684fc4526f2fdf65523abea2853ad11ba3c
7f8a95173e17256698324886bb138b7936b9e8c5b9ab8fffbfe01080f02f286c
SH256 hash:
7ded460209d15ff84b3542b5cf73a5faf1c1bff6eccbdd3234721616e66c46c7
MD5 hash:
1a373fc46c1f036b65ef05be30204ef9
SHA1 hash:
5742e348c205d1c463910c5b226a21d6738ba314
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
SH256 hash:
7ded460209d15ff84b3542b5cf73a5faf1c1bff6eccbdd3234721616e66c46c7
MD5 hash:
1a373fc46c1f036b65ef05be30204ef9
SHA1 hash:
5742e348c205d1c463910c5b226a21d6738ba314
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
SH256 hash:
973512f00ba81a790d2351f286c79dfea92692c9f7cd724e22ab11ff282f8130
MD5 hash:
3794c5f7b240e4184d6ea90c5bdd9ec6
SHA1 hash:
26b9c4a753779b4994fe38c16dfe70b07efd3e0d
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
SH256 hash:
973512f00ba81a790d2351f286c79dfea92692c9f7cd724e22ab11ff282f8130
MD5 hash:
3794c5f7b240e4184d6ea90c5bdd9ec6
SHA1 hash:
26b9c4a753779b4994fe38c16dfe70b07efd3e0d
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
SH256 hash:
0aea55a753fc5e090556cab151517684fc4526f2fdf65523abea2853ad11ba3c
MD5 hash:
c1ab6de5fc136f64db5f5c8227b50a2d
SHA1 hash:
b27a34429472a58c9a84d11b124008efbce5f777
Link:
https://www.unpac.me/results/0d5cc3fc-d764-4af1-9e37-0dd289bd2f22/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0aea55a753fc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 0aea55a753fc5e090556cab151517684fc4526f2fdf65523abea2853ad11ba3c

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/406465/

Comments