MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19e9e83de17d01983fe73b24b034831537e978652e6d6f0d70db6d48c72cb9c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 17

Intelligence 17 IOCs YARA 8 File information Comments

SHA256 hash:	19e9e83de17d01983fe73b24b034831537e978652e6d6f0d70db6d48c72cb9c2
SHA3-384 hash:	6a11c3b4111815043b6246d7df38bb39c6a107be262d290e82179875300a4014f8ca230d50c85cd02426dc2946df77f5
SHA1 hash:	cbbcc5a4092baa832742f54f185ec21f49ca7c4c
MD5 hash:	bf1ed0009a578efe9b871d2ec60e51fb
humanhash:	cardinal-stream-twelve-california
File name:	bf1ed0009a578efe9b871d2ec60e51fb.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	300'868 bytes
First seen:	2023-07-13 11:48:20 UTC
Last seen:	2023-07-14 07:04:36 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep	6144:vYa6/VzpkfSz+zcHd6IZB+EpsMidjlEhl7jS+HcYgaH4xJIzZHAy9Y:vY1VzOSz+zcHd64UdpxlEPjSlJIzZHA3
Threatray	4'843 similar samples on MalwareBazaar
TLSH	T16A5423143F88D49BFE3717361DB649633EDC262628B91D0F2B00AB0BF16668359097E7
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	obfusor
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

290

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

bf1ed0009a578efe9b871d2ec60e51fb.exe

Verdict:

Malicious activity

Analysis date:

2023-07-13 11:51:12 UTC

Tags:

agenttesla stealer

Link:

https://app.any.run/tasks/08765a30-d68a-4c0e-b4e9-8d347de44307

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/417350/

Detection(s):

Sanesecurity.Rogue.0hr.20230713-1235.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Creating a file

Unauthorized injection to a recently created process

Restart of the analyzed sample

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Сreating synchronization primitives

DNS request

Reading critical registry keys

Sending an HTTP GET request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Stealing user critical data

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/97435/overview

Behaviour

MalwareBazaar

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/19e9e83de17d01983fe73b24b034831537e978652e6d6f0d70db6d48c72cb9c2

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3f7d3da2-989d-4954-8023-81f274e85836

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1272446

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found malware configuration

Machine Learning detection for sample

Maps a DLL or memory area into another process

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/19e9e83de17d01983fe73b24b034831537e978652e6d6f0d70db6d48c72cb9c2/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-07-13 08:27:03 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dhu6qppbpuazqp7hhmslanedcu36s6dffzww6dlq3nwurrzmxhba._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

156c6d57b228e6b5a8920f268f26b70b5fb6ec53b255f102f2dc9f7fa21c9097

AgentTesla

17b85440e830fbef06c68240cf0024dad39a394409980195c360c0084c4be907

AgentTesla

2a6df4ce52a6d75e94e0e70e4892db53106458bbe3a18efcadfd2150bab937f4

AgentTesla

2b54d7c7b0a36a01a6e738444491ec07595757248471a3618f52ee812c283eb3

AgentTesla

65ad72896b92a9c6766a6a4c48543688efb10656fb8a353fe63cbf6ee0ed9fab

AgentTesla

7cd2ed629dd0e67f352edcb542ed9ed089b0e474a97701a4036a4c9b08b8f980

AgentTesla

aa4d7c8a7bd3a5690b8b2dc1ed9fc3bfd40981671b3642625fa3c7589bf459ac

AgentTesla

+ 4'833 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/230713-ny1c9shd9s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

a37abbb4c91fc5f974f095736630cda418193b82caa1f4f75389bf855257c701

MD5 hash:

d95069a077ab9edd0c1a3d17cc24c7ba

SHA1 hash:

971c94089814bd33898088132197efe7f05315a1

Link:

https://www.unpac.me/results/3e3b3692-7682-4276-95e6-97b89341623a/

SH256 hash:

fba60d5fdcdbeb9a77ce6b992572e3a229b126865b479069c772ab88b15687da

MD5 hash:

e15aee8b5216cb6bdf24a77387d7e7bc

SHA1 hash:

7ac49426ad0c94a7dc0aa7623ea7b950c405eb26

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/3e3b3692-7682-4276-95e6-97b89341623a/

Parent samples :

17b85440e830fbef06c68240cf0024dad39a394409980195c360c0084c4be907
156c6d57b228e6b5a8920f268f26b70b5fb6ec53b255f102f2dc9f7fa21c9097
7cd2ed629dd0e67f352edcb542ed9ed089b0e474a97701a4036a4c9b08b8f980
a8d70bf9cc12fbfb715e24cd0591c6e42d4f7e11b67b004255d16bbb26e0b43a
2bad3cf2729badd3d5d317b0ca215ba211ebdf12fc903f504ad81cffa22a7b93
aa4d7c8a7bd3a5690b8b2dc1ed9fc3bfd40981671b3642625fa3c7589bf459ac
19e9e83de17d01983fe73b24b034831537e978652e6d6f0d70db6d48c72cb9c2
2313b3f23146c4475ec50d51bea33e49f6167c799e418c4c08620e7a720edb04
1c71de5816aed5c4f8d677703ee09567ef0b80fb2e50acb2cf1c1ed931660ef1

SH256 hash:

71305433203ade50787ff344e922693adfc6768a67123385a5a35461895b2a44

MD5 hash:

f63b71623f24efa9b322d4b7476371e2

SHA1 hash:

59af74182deba5a51d1f77fbbf4801c525ba447b

Link:

https://www.unpac.me/results/3e3b3692-7682-4276-95e6-97b89341623a/

SH256 hash:

19e9e83de17d01983fe73b24b034831537e978652e6d6f0d70db6d48c72cb9c2

MD5 hash:

bf1ed0009a578efe9b871d2ec60e51fb

SHA1 hash:

cbbcc5a4092baa832742f54f185ec21f49ca7c4c

Link:

https://www.unpac.me/results/3e3b3692-7682-4276-95e6-97b89341623a/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/19e9e83de17d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV4 Create hunting rule
Author:	Rony (r0ny_123)

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	MSIL_SUSP_OBFUSC_XorStringsNet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:	https://github.com/dr4k0nia/yara-rules

Rule name:	msil_susp_obf_xorstringsnet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it

Rule name:	pe_imphash Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1c893ada8783c971c0fc9cce13ec65287f12dd70bc8b97bd820a22848bbe8719

AgentTesla

exe 19e9e83de17d01983fe73b24b034831537e978652e6d6f0d70db6d48c72cb9c2

(this sample)

Cape

https://www.capesandbox.com/analysis/417350/

Dropped by

SHA256 1c893ada8783c971c0fc9cce13ec65287f12dd70bc8b97bd820a22848bbe8719

Dropped by

MD5 2c9307d12d25cb58c3920eba0babae9b

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample