MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f3591120f2f986f136cc78f39ee44b66e002dd5dec008f814acc8b54de2a962. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 13

Intelligence 13 IOCs YARA 3 File information Comments

SHA256 hash:	0f3591120f2f986f136cc78f39ee44b66e002dd5dec008f814acc8b54de2a962
SHA3-384 hash:	3040581a16809ac2bdece7a1d64baf6cc29922d99bd70a6de82aeaecdda6ad1d920398b6cbb761eb772e78309cbde7c3
SHA1 hash:	ddc1871ed00e27658a756c9899a51b6fa5a09aa1
MD5 hash:	763772a6e8321fa148605aa253ed45d4
humanhash:	jupiter-batman-leopard-october
File name:	PO-91402278.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	619'520 bytes
First seen:	2023-03-14 00:59:42 UTC
Last seen:	2023-03-21 13:44:15 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep	12288:xnE5BhWH78QM8y46CAsQbxBtMm9CNzHMtN5lt+oLPSjW+:xnE5KbXP750BtMmoshnmj
Threatray	1'364 similar samples on MalwareBazaar
TLSH	T1E4D439ACF8AF51EDE5ACEDBB5A81C40F6BF35C2B76CDF95902923A140211519F8D202D
TrID	63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

269

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

PO-91402278.exe

Verdict:

Malicious activity

Analysis date:

2023-03-14 01:02:33 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/0659fe85-bbb4-40f0-80f2-61830bd798a7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/374105/

Detection(s):

Sanesecurity.Rogue.0hr.20230313-1933.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Сreating synchronization primitives

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/640fc716c3fe900de1187870/reports/d8460022-6be9-46e4-9772-c0b1b4d6d61e/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/0f3591120f2f986f136cc78f39ee44b66e002dd5dec008f814acc8b54de2a962

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3741bbc7-8008-4c1f-a19d-d89de3421296

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1192962

Signature

Injects a PE file into a foreign processes

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0f3591120f2f986f136cc78f39ee44b66e002dd5dec008f814acc8b54de2a962/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-03-13 16:42:55 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=b42zceqpf6mg6e3my6htt3sewzxaalov33aar6auvtelktpcvfra._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

29efaf03dee08b4e3f4e23e41b9581513da070dc49e746e91aee2022fef12088

AgentTesla

3d89d938245c8482b052606671e22041cae0ca7b12bb59214726b9dedb59f3a1

AgentTesla

5fdb6e2373c18ec9d19f822279bce3d0e84c731ae8c0410fdd613c59379e6ad9

AgentTesla

7ae177e05410a5674d60e619122fda381ca12b03bf136d6cb595a857c2cb51c3

AgentTesla

afee69594c18577546ad73e410935b8ae9a1038d0eed643333037a1cceb06724

AgentTesla

e8738a421e052a4b0824102fc4a1d6d530dfa5ab90a651e0aca6ff8730d2bc02

AgentTesla

ebfe3afe48dc47239d68700f74f01db8aef2b4c20f833178de5d55988d05a06a

AgentTesla

+ 1'354 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230314-bcnfcscf89/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AgentTesla

Unpacked files

SH256 hash:

755310dafcbf899b04a00615f7601e8bdab68a94ee909d923c7b45a36cfb3e34

MD5 hash:

5ed387cf84abe5e42f0a1366a750da6d

SHA1 hash:

d13920ada1635d1d3691535bce3b16fee5ddb0b3

Link:

https://www.unpac.me/results/8f808027-dff7-4d86-8122-e2627176f9f9/

SH256 hash:

a7e17fcf14d55ff0ea177ea38105131dbb6cad90da1d22e24bbd2f33b9367a96

MD5 hash:

2bb5bbc146586605498fde034fbb861a

SHA1 hash:

9f3ebac3375bc1e6a7eb4276a977ac36d2fc3e09

Link:

https://www.unpac.me/results/8f808027-dff7-4d86-8122-e2627176f9f9/

Parent samples :

64e8bab99d5b2d4f60126625fc49cc873a8b3298a3ea7cb50197b0cbbc47d356
c4412128ec553fc7dd04832d11ccd68c8db5f08729ac401b78fba4c022127625
186fb618cd82863206b3da72960bb3c4dfa9ec3beafb10cc49fabd34f7cda05f
0693896df2ac61be0617616cae39f1d1c9b60c7953b9c45c93fa63d3764a1680
f8d54f533d483b1dd4bca77d1fdbbfe2165c2e63c06f9bb44c2b5c37d384b100
5522c9cb389b36d40cafd0cb1820934cdf53fe86827677cfe19b7b58d5affce6

SH256 hash:

ea8d4c91ec5bba5e1db6c17730d7ba5cdbb5ff3c1a777f70c90e91ce599d9b5d

MD5 hash:

27f5124bf8f451bca8d8a15c73c4f521

SHA1 hash:

5fd557e109b8fd1c3b362b64f0ba9f1600c07211

Link:

https://www.unpac.me/results/8f808027-dff7-4d86-8122-e2627176f9f9/

SH256 hash:

0f3591120f2f986f136cc78f39ee44b66e002dd5dec008f814acc8b54de2a962

MD5 hash:

763772a6e8321fa148605aa253ed45d4

SHA1 hash:

ddc1871ed00e27658a756c9899a51b6fa5a09aa1

Link:

https://www.unpac.me/results/8f808027-dff7-4d86-8122-e2627176f9f9/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0f3591120f2f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/0f3591120f2f986f136cc78f39ee44b66e002dd5dec008f814acc8b54de2a962

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing URLs to raw contents of a Github gist