MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d66c5841f92c0092425ee027c8effb420b8ad90a26130bec62fd5d04d501d8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d66c5841f92c0092425ee027c8effb420b8ad90a26130bec62fd5d04d501d8f
SHA3-384 hash: 7456e1e29d231725aae9cbb18f32045478b227b9385ccadfe9fe8218cfd1850c563166fb0d93e15b747bb8416b97d530
SHA1 hash: 1e987e5061dcb86fd4d381a9be65df50b8b423fc
MD5 hash: c31cedc1de555c98a1651123b8ed5262
humanhash: jupiter-glucose-uranus-india
File name:c31cedc1de555c98a1651123b8ed5262
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'148'416 bytes
First seen:2023-06-01 02:06:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:N3pLaVUH999H9j8zHVh3tMQt5+YyyRbzOOKF:FtBH9Hazb3Xt53yytzOOKF
Threatray 1'801 similar samples on MalwareBazaar
TLSH T1FC350100A3BF8B2BC13B5BF646159734A7F666AA743ED3159EC225DB06B2F400D41B1B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter zbetcheckin
Tags:32 AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
292
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
c31cedc1de555c98a1651123b8ed5262
Verdict:
Malicious activity
Analysis date:
2023-06-01 02:07:43 UTC
Tags:
rat agenttesla
Link:
https://app.any.run/tasks/6159e463-046f-43b4-957d-194b16afca44

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XorStringsNET
Create hunting rule
Link:
https://www.capesandbox.com/analysis/394231/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.67310648.6333.8009.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin packed
Link:
https://www.filescan.io/uploads/6477fd464df06e5215358cd8/reports/0a809965-d190-4b90-a614-55e2d0e34d57/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/0d66c5841f92c0092425ee027c8effb420b8ad90a26130bec62fd5d04d501d8f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3851ac99-a952-4915-a642-252a8b9791e2
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1246496
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 879516 Sample: fszN7E2JQv.exe Startdate: 01/06/2023 Architecture: WINDOWS Score: 80 19 Malicious sample detected (through community Yara rule) 2->19 21 Antivirus / Scanner detection for submitted sample 2->21 23 Multi AV Scanner detection for submitted file 2->23 25 3 other signatures 2->25 6 fszN7E2JQv.exe 3 2->6         started        process3 file4 17 C:\Users\user\AppData\...\fszN7E2JQv.exe.log, ASCII 6->17 dropped 9 vbc.exe 6->9         started        11 vbc.exe 6->11         started        13 vbc.exe 6->13         started        15 2 other processes 6->15 process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0d66c5841f92c0092425ee027c8effb420b8ad90a26130bec62fd5d04d501d8f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-30 21:47:44 UTC
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bvtmlba7slaasjbf5ybhzdx7wqqlrlmqujqtbpwgf7k5atkqdwhq._file
Verdict:
malicious
Similar samples:
16c87c0de9538e8cac5d187949b3fe9b1a11ee1ed2bcdcc726ea47115d6701e1
AgentTesla
5fe5a55457de5cc7d0042b3d4bd4d60f30340e31cb4ca60fcb775a393dd0ae6d
AgentTesla
70d856cfc4e27c7ca18c939fd13fb989a308c64c0cd78d5d6f07759cc355c3db
AgentTesla
7bf161d2aba8c0ddcd67192f4c8d851bdc99acbcabf12fe75b5d68c7414ce0ba
AgentTesla
95b8e0bead7a576cc494ab4f34737a966d60abf551dae5e68c44a3be895c4913
AgentTesla
9e392cb448daf1882dac5f6fbc0d736c76bed78befee2c8b513241b8ed6a95a0
AgentTesla
b1b8ff83e0ab9708e7d30f7df18834705dcb8576226581cb6a9a8995286728d5
AgentTesla
b1dac250b790090d75044bf149fb5e5372fed13d4c44999e4653a159d96c63b0
AgentTesla
cefd971616a56a52fa3c0cb966cfc4c982413038cb0907baca5170e1bd585b4c
AgentTesla
+ 1'791 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230601-cjzbwace3v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Uses the VBS compiler for execution
AgentTesla
Unpacked files
SH256 hash:
22fc4fcbaf3df00d7a079bf59b7ff96dc54e4c2a55b7582fdf5b2c3c297dcc67
MD5 hash:
f2e4837abeae0b885bad0c3897672cba
SHA1 hash:
5e76218e15084d478c429c16380a3a9a2dcf8266
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/6ff36ff8-7957-4b91-9635-6e3031494ac7/
SH256 hash:
ceeb49981370bdd503f533ca301bfeb87bbb0c35dff36111ba2b39e8d49ff119
MD5 hash:
35ba0220a2b3a3ead946212babe62c66
SHA1 hash:
22e78716e8601604c36595c3c37e316631bbd848
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/6ff36ff8-7957-4b91-9635-6e3031494ac7/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/6ff36ff8-7957-4b91-9635-6e3031494ac7/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
7e32d476140a41d3c4885c6f55a5fe977c44c907fd53a09e5ddda422116cc0ac
MD5 hash:
e645da94dfd60d6b1b7b44f73a9ccd22
SHA1 hash:
8f8a3393aad251cf3a176c4867899a0c7d9fe18b
Link:
https://www.unpac.me/results/6ff36ff8-7957-4b91-9635-6e3031494ac7/
SH256 hash:
74102eae0242354f09a017aeb3c6523be6fa88b7688a14a71f98bc2a791c885d
MD5 hash:
768ff499274db8f480246a8f6bf630fd
SHA1 hash:
8aef866b78f2e7c314f3e73e2140aa172ef583b6
Link:
https://www.unpac.me/results/6ff36ff8-7957-4b91-9635-6e3031494ac7/
SH256 hash:
651c9f48cba41eeb13513cad8d53c746dfd505d54aa0ba1658fe65e0b4bb8858
MD5 hash:
50778c9ceab6edafd494d9463167f836
SHA1 hash:
635599d4218c24f3a63fdd6031c5e489e8fdf148
Link:
https://www.unpac.me/results/6ff36ff8-7957-4b91-9635-6e3031494ac7/
SH256 hash:
f65d6c87102a18d7897c08ba82697e0b4808a8307b584d25a42aea016a41e7f8
MD5 hash:
7299310139d8fd6d9f2c067d13b3824e
SHA1 hash:
3bbc1160b82f289b5e8683d790a2ec1263998930
Link:
https://www.unpac.me/results/6ff36ff8-7957-4b91-9635-6e3031494ac7/
SH256 hash:
0d66c5841f92c0092425ee027c8effb420b8ad90a26130bec62fd5d04d501d8f
MD5 hash:
c31cedc1de555c98a1651123b8ed5262
SHA1 hash:
1e987e5061dcb86fd4d381a9be65df50b8b423fc
Link:
https://www.unpac.me/results/6ff36ff8-7957-4b91-9635-6e3031494ac7/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0d66c5841f92/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0d66c5841f92c0092425ee027c8effb420b8ad90a26130bec62fd5d04d501d8f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 0d66c5841f92c0092425ee027c8effb420b8ad90a26130bec62fd5d04d501d8f

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2648403/
Cape
Cape
https://www.capesandbox.com/analysis/394231/

Comments


Avatar
zbet commented on 2023-06-01 02:06:17 UTC

url : hxxp://195.178.120.24/U2th5k1keGkDeMw.exe