MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f176b21404c995d449d4abfa9ac7c9614c2ee2f3a204efffa3783dd16832c58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f176b21404c995d449d4abfa9ac7c9614c2ee2f3a204efffa3783dd16832c58
SHA3-384 hash: 128b633a9f5580ac196ab8e79933e5eecbcb7aa0b797cf81df567d40f5b5c048e84b3c5b81d162a41f2dec8d11e14a7a
SHA1 hash: 01a651bf68381ea7e558c4aa8160974c52616359
MD5 hash: 7e43c565adfaee241b5011835d240e93
humanhash: nevada-seventeen-romeo-king
File name:Booking_261.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'249'384 bytes
First seen:2024-09-09 11:30:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:np+zf6hKGUSxWm3d3i31YRJpJYad1u6yWSgjrUrF:p+GtWINq1YRJpJYaHwuE
Threatray 2'017 similar samples on MalwareBazaar
TLSH T13245D01117499896F7420D759FEAD03061385E9FE4B8C94F2A8EBB1287F3312507FBA9
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
File icon (PE):PE icon
dhash icon 92b2aca6a6ba8e9e (6 x AgentTesla, 5 x PureCrypter, 4 x SnakeKeylogger)
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
420
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
Booking_261.exe
Verdict:
Malicious activity
Analysis date:
2024-09-09 12:02:03 UTC
Tags:
netreactor evasion stealer agenttesla exfiltration crypto-regex smtp
Link:
https://app.any.run/tasks/d7ab0f45-ac50-45ab-8de0-74bd2180427e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.32260.15953.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66dedc7a6b8536bde965e02c
Tags:
Encryption Static Stealth Msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% directory
Launching a process
Creating a file in the %temp% directory
Сreating synchronization primitives
Creating a process from a recently created file
Creating a window
Enabling the 'hidden' option for files in the %temp% directory
Creating a file
Moving a recently created file
Searching for the window
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending a custom TCP request
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Stealing user critical data
Connection attempt to an infection source
Sending a TCP request to an infection source
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/66dedc7c8bdeb2969e1a7388/reports/863270b5-975b-4a56-8aa5-b72cbfe6ae00/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/0f176b21404c995d449d4abfa9ac7c9614c2ee2f3a204efffa3783dd16832c58
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/11d0812f-9a0f-4e1b-8c59-56a539db3e4d
Result
Threat name:
AgentTesla, Clipboard Hijacker
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1507887
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Clipboard Hijacker
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1507887 Sample: Booking_261.exe Startdate: 09/09/2024 Architecture: WINDOWS Score: 100 53 api.ipify.org 2->53 61 Suricata IDS alerts for network traffic 2->61 63 Found malware configuration 2->63 65 Malicious sample detected (through community Yara rule) 2->65 67 11 other signatures 2->67 8 Booking_261.exe 1 4 2->8         started        12 Oswaores.exe 2 2->12         started        14 Oswaores.exe 2 2->14         started        signatures3 process4 file5 49 C:\Users\user\AppData\Roaming\Oswaores.exe, PE32 8->49 dropped 51 C:\Users\...\Oswaores.exe:Zone.Identifier, ASCII 8->51 dropped 83 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 8->83 85 Writes to foreign memory regions 8->85 87 Injects a PE file into a foreign processes 8->87 16 InstallUtil.exe 5 8->16         started        89 Antivirus detection for dropped file 12->89 91 Multi AV Scanner detection for dropped file 12->91 93 Machine Learning detection for dropped file 12->93 19 InstallUtil.exe 12->19         started        21 InstallUtil.exe 14->21         started        signatures6 process7 file8 37 C:\Users\user\AppData\...\FB_EA9.tmp.exe, PE32 16->37 dropped 39 C:\Users\user\AppData\...\FB_105F.tmp.exe, PE32 16->39 dropped 23 FB_EA9.tmp.exe 15 2 16->23         started        27 FB_105F.tmp.exe 7 16->27         started        41 C:\Users\user\AppData\...\FB_6AE3.tmp.exe, PE32 19->41 dropped 43 C:\Users\user\AppData\...\FB_698A.tmp.exe, PE32 19->43 dropped 29 FB_698A.tmp.exe 19->29         started        31 FB_6AE3.tmp.exe 19->31         started        45 C:\Users\user\AppData\...\FB_89A6.tmp.exe, PE32 21->45 dropped 47 C:\Users\user\AppData\...\FB_883E.tmp.exe, PE32 21->47 dropped 33 FB_883E.tmp.exe 21->33         started        35 FB_89A6.tmp.exe 21->35         started        process9 dnsIp10 55 162.254.34.31, 49732, 49740, 49742 VIVIDHOSTINGUS United States 23->55 57 api.ipify.org 104.26.13.205, 443, 49731 CLOUDFLARENETUS United States 23->57 69 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 23->69 71 Tries to steal Mail credentials (via file / registry access) 23->71 73 Machine Learning detection for dropped file 23->73 59 172.67.74.152, 443, 49739, 49741 CLOUDFLARENETUS United States 29->59 75 Antivirus detection for dropped file 33->75 77 Multi AV Scanner detection for dropped file 33->77 79 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 33->79 81 2 other signatures 33->81 signatures11
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0f176b21404c995d449d4abfa9ac7c9614c2ee2f3a204efffa3783dd16832c58
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f176b21404c995d449d4abfa9ac7c9614c2ee2f3a204efffa3783dd16832c58/
Threat name:
Win32.Trojan.GenSteal
Create hunting rule
Status:
Malicious
First seen:
2024-09-03 03:08:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
20
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b4lwwikajsmv2re5jk72tld4sykmf3rphiqe5772g6b52fudfrma._file
Verdict:
malicious
Label(s):
agenttesla_v4
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
0b8698357d915b97225ab82204e9b4faf9b291286dc595edf2f5798627a11bd6
AgentTesla
16d9783e034d3ff5012dbf7ffa092edaafc47fdf8db16142b7128962c844251c
AgentTesla
2debf2cfc6d46684b470e7be05a95b5de3675f16b61b07a23469d1b61b29a6fc
AgentTesla
92a3d5b50db0cd8d8328faf9d2ce8f583d6fc20e81c03b1a99836bd58558a892
AgentTesla
9836d5f206e78ec36183c9dd7ba5a13c7d107c43482b94cddd06ee2914ae4adc
AgentTesla
a705803d36a853fea252b00451b392245ee4d66f9c830778d021cdefaf252136
AgentTesla
ae32cc3e1a68afcb91062da04f99d65ddc9ed3feff5c95c99f2bd1487a9b3006
AgentTesla
+ 2'007 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/240909-nmp36avgmm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c1dff068-f285-43ac-a0fa-7e3050058dc7
Unpacked files
SH256 hash:
fb247f5397ba1b2d9328d1acc2fd322181a91ced1953853abb41718dc21198ae
MD5 hash:
a21df2c0cca131eb534f520fd641adb5
SHA1 hash:
cd39e12e326191888b836c3419ac2cb71c2b5b11
Detections:
AgentTesla
Create hunting rule
win_agent_tesla_g2
Create hunting rule
Agenttesla_type2
Create hunting rule
Link:
https://www.unpac.me/results/238227be-219b-49a7-8dab-e197b7f3fa1f/
Parent samples :
0f176b21404c995d449d4abfa9ac7c9614c2ee2f3a204efffa3783dd16832c58
4d7489c7f5c86e43100b25314f49f3577d43ae47e090b0916578da82ec3d59e6
65ea7c521264d69a5e044a2fa7aa5a330385e733b1cefbff31cb805abaf067fa
fb247f5397ba1b2d9328d1acc2fd322181a91ced1953853abb41718dc21198ae
8ad905fc93383ead3be4caa578a8b1fd7cc59ba217fc86a2c2eca8997c0db8aa
1601868b52e7858aadf8f37a26d720fcd2ce0697cdefee537bf17c12879d6245
8e7ea1546b86935573d6ebcb6017b10557cedf8bc168243fdfcecf84b02f15d3
02114391e08d4e5e5f201dfc840af578b93f344e6a7edfd3632799ab353a4a88
a10431e043b70db47e5617767f04f8565b7c5af7de0e76256190d56565fc06b1
b46c2cb0bca50540123bbde92aa6f434b0d587a7de93916dd5a03682563b1141
2f4e209c6f1f1f5eedab708b4d6eb2af6767eed3e391d93972b38b3261627b6f
ead3cd3ddf7138948dcbdcdef2ba5759b87d2693c726ce16af3d673a651a28b4
82f25cda7187cea3cfd35a12235584e35922fbfbe3ac6f5bc702a40fa337deb5
SH256 hash:
46e8d3ac396c8a5bbabe3213890607206daaf2de15fe278bb23418323d4f6183
MD5 hash:
fc90f7835f306cead719415854270d92
SHA1 hash:
924540a094de44f2359420b13dc455db8b198cca
Link:
https://www.unpac.me/results/238227be-219b-49a7-8dab-e197b7f3fa1f/
SH256 hash:
fb2101cc53c5e5e29162fe46851b2e1d7eb682642364c81fa824b37c6e32a926
MD5 hash:
3c149955edfbf01a4a3ca9f3e6d82716
SHA1 hash:
757f5556b019198c16872c11eb11afb1cb44b709
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/238227be-219b-49a7-8dab-e197b7f3fa1f/
SH256 hash:
8f0e069f5d0ee644fcc391d825f9aedd7344ed13e546c7a97f65489e7df4894b
MD5 hash:
f711839a863cede381e944741f6bc6e1
SHA1 hash:
53c1113331cac8caec5c37c9b87ab5eb504c61c7
Detections:
win_agent_tesla_g2
Create hunting rule
Agenttesla_type2
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/238227be-219b-49a7-8dab-e197b7f3fa1f/
SH256 hash:
19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372
MD5 hash:
4e29f75c0c51b9dec76955f0382d9541
SHA1 hash:
4899aa8e3f57339cbaec8faab777897a76fe1c3a
Link:
https://www.unpac.me/results/238227be-219b-49a7-8dab-e197b7f3fa1f/
SH256 hash:
8b7c95e75a1740d0e21ad8bab0543d7646c058226c2a72d8e5942c1381c318b3
MD5 hash:
3e7252b768f888767749b523c7786a94
SHA1 hash:
3ce68340cdddf2571ab18d5bf99fd36312db4161
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/238227be-219b-49a7-8dab-e197b7f3fa1f/
SH256 hash:
78f73e1734daa918b253517c75971fbb8df773a3d77d02a752e9a0ad1711a677
MD5 hash:
f9d2985aa1c41cca281321fffb5ed424
SHA1 hash:
3a7a58d2dcae2762882357ae34d372744b1dbb9d
Link:
https://www.unpac.me/results/238227be-219b-49a7-8dab-e197b7f3fa1f/
SH256 hash:
0f176b21404c995d449d4abfa9ac7c9614c2ee2f3a204efffa3783dd16832c58
MD5 hash:
7e43c565adfaee241b5011835d240e93
SHA1 hash:
01a651bf68381ea7e558c4aa8160974c52616359
Detections:
SUSP_OBF_NET_Eazfuscator_String_Encryption_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/238227be-219b-49a7-8dab-e197b7f3fa1f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/0f176b21404c995d449d4abfa9ac7c9614c2ee2f3a204efffa3783dd16832c58

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 0f176b21404c995d449d4abfa9ac7c9614c2ee2f3a204efffa3783dd16832c58

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments