MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 156aae9a22259a3682fff3d9a904dc443bbf6fd77192092ae5e3a9fed9cc792d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 156aae9a22259a3682fff3d9a904dc443bbf6fd77192092ae5e3a9fed9cc792d
SHA3-384 hash: c92b7f9ad77fc4992ed5252f794bffe41b5a0d124f689625dad7ad8b860f934e41c5f67d4877bf3f82f8d8ee0e65cc40
SHA1 hash: fe2f8120600d77852a8133cf81637e6511c5420a
MD5 hash: 805dff76d392e5e8b803f82a3bc8ad8f
humanhash: timing-illinois-yankee-bacon
File name:DHL AWB#5862701084.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:940'544 bytes
First seen:2023-10-18 16:34:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:l3FSu6eDh4IGeqPu4CjMz/0A07GKXPA9IPcN6iVcl8Vw:NsudDhdwPu4/rh0yFNdil8
Threatray 735 similar samples on MalwareBazaar
TLSH T10F156B7D1EF88227B978DAA6DFA0C432F061D6EBF5665D2AD0E746418706803B4C70BD
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter malwarelabnet
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
308
Origin country :
CA CA
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.27641.7083.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/6530093810dbe5fb92cde409/reports/65dc0a13-74b7-4ea8-8061-ca9662333e16/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/156aae9a22259a3682fff3d9a904dc443bbf6fd77192092ae5e3a9fed9cc792d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a71f39a4-aa61-4f94-95e3-13d0bb58e429
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
n/a
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1328209
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large strings
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/156aae9a22259a3682fff3d9a904dc443bbf6fd77192092ae5e3a9fed9cc792d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/156aae9a22259a3682fff3d9a904dc443bbf6fd77192092ae5e3a9fed9cc792d/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-10-18 16:35:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
14 of 22 (63.64%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cvvk5grcewndnax76pm2sbg4iq53636xogjaskxf4ou75wompewq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
08f08e212e3159eae344cda00b2ecd5a5718b326ecb53499ca01ef3cf1f33da7
AgentTesla
1941fd80fd284baeb6d794cf73f6d0dd2a37fb419bd4739966dc6182842a3517
AgentTesla
57a285820956c77b8f6c8720ad8f2612d00012991d002b975cbb14310d481956
AgentTesla
6fedb05b8cf5b61e947236d5933ad251a3d47dc8b3415ef50ad2d763df91cd16
AgentTesla
9713b05ec993df32ea7adfcc391bf45486b291ab7fcfb465b1b9c92eaa321826
AgentTesla
d0475c384cd4d7b6ea2c3460a07c49fd59aafe87841e479d7965c3384ccec67d
AgentTesla
e4c2c8f842ce22820f548ebae96def1fff8f86ce6c92adc4ff801d4adf46e1c9
AgentTesla
e8d0cc3c7ea34571768f840ae00c2f81f08ce08a1cf237c2374f47bd3f0da646
AgentTesla
ec88127f108bf2d3963c92a80950bc8d6d2cfef67c6acdec7793169b89000ad1
AgentTesla
+ 725 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/231018-t3m7dshg33/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
de59c3246c72163cfc5d3b5a8aec72ec6a585893a6c7d80fbff35238aabe6027
MD5 hash:
c3b2bcacf04baacd6daae4cf4896872c
SHA1 hash:
b7815d4d77ea49e493898d9ce06061e2c9c83feb
Link:
https://www.unpac.me/results/d3f14623-399d-40fb-bbb3-703a90949125/
SH256 hash:
ed278807068709bcc74ef7d01ce46682b64d8ec9c8466dc8aaeb92ed75495aaa
MD5 hash:
51e85d063788811778e570139e28ac5a
SHA1 hash:
b3a9f24d4d25c91058e6c1f91e07219423b428fa
Link:
https://www.unpac.me/results/d3f14623-399d-40fb-bbb3-703a90949125/
SH256 hash:
ac89d43d85301ff59815b36cb7a338e68e76913ebd44a5e18680c77ef0aa7669
MD5 hash:
93bb343d511de9f8b4b431036a1a535b
SHA1 hash:
ac62172b4bba0f35a12c304f09d95010ad747ea0
Link:
https://www.unpac.me/results/d3f14623-399d-40fb-bbb3-703a90949125/
SH256 hash:
711e9194e6445125fee905f499102c525d5832df78f90b8cef426240f8b751ff
MD5 hash:
be59aa41a807a9a70f643f80531eeb0f
SHA1 hash:
73c1e2fa96744b8e7e3e1bb8b071a3557519ab56
Detections:
AgentTesla
Create hunting rule
win_agent_tesla_g2
Create hunting rule
Link:
https://www.unpac.me/results/d3f14623-399d-40fb-bbb3-703a90949125/
SH256 hash:
8231d057b01cbe47d2d3b235a297f245ac0cd77d2fe89ba0139b981023cbec05
MD5 hash:
fdc555789e1bd60d9403ea216427758d
SHA1 hash:
57a120ed791d7d78ca54f6cffa320705f62cbabc
Link:
https://www.unpac.me/results/d3f14623-399d-40fb-bbb3-703a90949125/
SH256 hash:
156aae9a22259a3682fff3d9a904dc443bbf6fd77192092ae5e3a9fed9cc792d
MD5 hash:
805dff76d392e5e8b803f82a3bc8ad8f
SHA1 hash:
fe2f8120600d77852a8133cf81637e6511c5420a
Link:
https://www.unpac.me/results/d3f14623-399d-40fb-bbb3-703a90949125/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/156aae9a2225/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/156aae9a22259a3682fff3d9a904dc443bbf6fd77192092ae5e3a9fed9cc792d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments