MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 156edd0a9601b7c286fc43e7726662bd7ff72ab0cf0ddb6a229683359008c823. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 156edd0a9601b7c286fc43e7726662bd7ff72ab0cf0ddb6a229683359008c823
SHA3-384 hash: 9e4d67588004aa3ba671eab38d5faac420f7405af47445c952159929bdcb636f73cb05785aca54238f216fa57aa632fb
SHA1 hash: 74879d0dddb78478f85c38b86834d73c50786ebe
MD5 hash: 763fbc464d5b5be82e341a4109543bc2
humanhash: foxtrot-beryllium-idaho-kilo
File name:156edd0a9601b7c286fc43e7726662bd7ff72ab0cf0ddb6a229683359008c823
Download: download sample
Signature AgentTesla
Create hunting rule
File size:868'352 bytes
First seen:2023-07-07 09:30:42 UTC
Last seen:2023-07-07 10:38:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:NdvDcAwlpaQobjSFLOfWoV0s1gDD1GdwLMDYF1t:NdvQRlpdijSofWC1mGygDe1
Threatray 3'406 similar samples on MalwareBazaar
TLSH T143051248B33F8722C9B797F294006671037A5F9E3E20D36D4DD7B5EAAA66B0503A1C47
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
267
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
156edd0a9601b7c286fc43e7726662bd7ff72ab0cf0ddb6a229683359008c823
Verdict:
Malicious activity
Analysis date:
2023-07-07 09:32:13 UTC
Tags:
rat agenttesla
Link:
https://app.any.run/tasks/3312ad6a-188e-4fa1-b766-ccdf304e4039

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/410436/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.67669528.16753.29429.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Launching a process
Creating a file
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64a7db571ed257496a5869d9/reports/a5fb387e-9e8a-49a4-a4c3-86e8efe9657b/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/156edd0a9601b7c286fc43e7726662bd7ff72ab0cf0ddb6a229683359008c823
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d085d604-165c-4ba1-a839-28cc2d1680c7
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/156edd0a9601b7c286fc43e7726662bd7ff72ab0cf0ddb6a229683359008c823/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-06-21 11:56:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
22 of 38 (57.89%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cvxn2cuwag34fbx4iptxeztcxv77okvqz4g5w2rcs2btleaizarq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0d00e23ae3b37a998466aff5c579afa4cf1bc707dd66e75f09f3909dd4f38cc6
AgentTesla
4d60f9998376b2059e5a19aa9337f44285cce66c0e6bf0535de18a87d3aaf973
AgentTesla
9197cc85a9c5fc3d9463da236c1c96551a0e805bdfd2d3c133a479f9b2ae6d0a
AgentTesla
c1b407328dfb3df00e409a9c3661b8ed81aea549322104e30929f1d669404d06
AgentTesla
d2b24cbb8fe2a9485ea49df5ffd98cd0073cd47de55e0da79e91618afc4528fe
AgentTesla
f37444849fb5d3f512aa399c0ccc8bbac2dac9a725c7965f445cc472f64a727e
AgentTesla
+ 3'396 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230707-lg2hwsgb68/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
AgentTesla
Unpacked files
SH256 hash:
6ea387a681c6903d7db8107c7d88002b83dc6d7bcfcc07b2fd86103e878e2d80
MD5 hash:
3673fabf48dfbd9bebe7928d7578c3fd
SHA1 hash:
fb011cdbe0ed03c64af5ddc91c0b45c1105b70b8
Link:
https://www.unpac.me/results/e31abfae-be5f-4fc9-be89-6ccee2138bc7/
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/e31abfae-be5f-4fc9-be89-6ccee2138bc7/
SH256 hash:
87d82d63be5a78b054ea4750731231966552a8b27ebde0489a6b52b5a67a14b6
MD5 hash:
863eab011dbb2b1e478169b916acc216
SHA1 hash:
df1232b40ba67106899b74f7a1912f72885bfc19
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/e31abfae-be5f-4fc9-be89-6ccee2138bc7/
Parent samples :
514be543f4e307be6133a891b83720ec896a19fb44a57cf3df0b9717848fc040
7c7c175dfa9da91a269d895d032e23574102163d9b6a37d4969f16e54dca120d
6d7877be905049d2f5a8716b8e778ab4e32f4ee52e1496afa1c6e8bb8dd5ff49
90fb63402e42d02695cf388e248f6001e7ac20242837387df1fa8757c827cad7
135e204ebe9c5fc699eeb7cdb425d2bf184ccbe5a092bf792bc6be37d865c7fa
25f6d614b2f6f1cf5b2723524be81a6ae6f1d79b221b62e3b3d05dc79a8ca770
5a925dd08badf3436cb55fc88cf7cbea994d3a02f7b3fe2d5d476846dc70fe83
611dad2e5706b08c8c13bf36b1b343258f4ff4182da5755de5f690d51a84bbb9
dd97e442a5d58e6c58f21d6ab84a80dd0b111ddbfbd7ab7feed758dac15eebad
817bd982ca96a349552017122eab3db9f948bdabe4fad431145085e10ded2a9d
156edd0a9601b7c286fc43e7726662bd7ff72ab0cf0ddb6a229683359008c823
SH256 hash:
63bbd332d658d285031956265b9abe731f5297ca988232525ac705e5f51bee45
MD5 hash:
6c297225ec9838c3e39f20b21aa1a5c1
SHA1 hash:
c6215be26834874541fa9110e65595cb85ce6fc9
Link:
https://www.unpac.me/results/e31abfae-be5f-4fc9-be89-6ccee2138bc7/
SH256 hash:
fcd9a285076c520c73421fa9b0456c06cdbb3c087481f167e6bd5b18555dc191
MD5 hash:
bc1c82571e046deac0795f832966fda6
SHA1 hash:
76a5bf8577374c9e61abc76f4ba88ee044580525
Link:
https://www.unpac.me/results/e31abfae-be5f-4fc9-be89-6ccee2138bc7/
SH256 hash:
6ea387a681c6903d7db8107c7d88002b83dc6d7bcfcc07b2fd86103e878e2d80
MD5 hash:
3673fabf48dfbd9bebe7928d7578c3fd
SHA1 hash:
fb011cdbe0ed03c64af5ddc91c0b45c1105b70b8
Link:
https://www.unpac.me/results/e31abfae-be5f-4fc9-be89-6ccee2138bc7/
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/e31abfae-be5f-4fc9-be89-6ccee2138bc7/
SH256 hash:
87d82d63be5a78b054ea4750731231966552a8b27ebde0489a6b52b5a67a14b6
MD5 hash:
863eab011dbb2b1e478169b916acc216
SHA1 hash:
df1232b40ba67106899b74f7a1912f72885bfc19
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/e31abfae-be5f-4fc9-be89-6ccee2138bc7/
Parent samples :
514be543f4e307be6133a891b83720ec896a19fb44a57cf3df0b9717848fc040
7c7c175dfa9da91a269d895d032e23574102163d9b6a37d4969f16e54dca120d
6d7877be905049d2f5a8716b8e778ab4e32f4ee52e1496afa1c6e8bb8dd5ff49
90fb63402e42d02695cf388e248f6001e7ac20242837387df1fa8757c827cad7
135e204ebe9c5fc699eeb7cdb425d2bf184ccbe5a092bf792bc6be37d865c7fa
25f6d614b2f6f1cf5b2723524be81a6ae6f1d79b221b62e3b3d05dc79a8ca770
5a925dd08badf3436cb55fc88cf7cbea994d3a02f7b3fe2d5d476846dc70fe83
611dad2e5706b08c8c13bf36b1b343258f4ff4182da5755de5f690d51a84bbb9
dd97e442a5d58e6c58f21d6ab84a80dd0b111ddbfbd7ab7feed758dac15eebad
817bd982ca96a349552017122eab3db9f948bdabe4fad431145085e10ded2a9d
156edd0a9601b7c286fc43e7726662bd7ff72ab0cf0ddb6a229683359008c823
SH256 hash:
63bbd332d658d285031956265b9abe731f5297ca988232525ac705e5f51bee45
MD5 hash:
6c297225ec9838c3e39f20b21aa1a5c1
SHA1 hash:
c6215be26834874541fa9110e65595cb85ce6fc9
Link:
https://www.unpac.me/results/e31abfae-be5f-4fc9-be89-6ccee2138bc7/
SH256 hash:
fcd9a285076c520c73421fa9b0456c06cdbb3c087481f167e6bd5b18555dc191
MD5 hash:
bc1c82571e046deac0795f832966fda6
SHA1 hash:
76a5bf8577374c9e61abc76f4ba88ee044580525
Link:
https://www.unpac.me/results/e31abfae-be5f-4fc9-be89-6ccee2138bc7/
SH256 hash:
156edd0a9601b7c286fc43e7726662bd7ff72ab0cf0ddb6a229683359008c823
MD5 hash:
763fbc464d5b5be82e341a4109543bc2
SHA1 hash:
74879d0dddb78478f85c38b86834d73c50786ebe
Link:
https://www.unpac.me/results/e31abfae-be5f-4fc9-be89-6ccee2138bc7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/156edd0a9601b7c286fc43e7726662bd7ff72ab0cf0ddb6a229683359008c823

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/410436/

Comments