MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24857c1d542e4013445cb7a2c9f5c0c606c4a4361423f0b422ada5089cd92706. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24857c1d542e4013445cb7a2c9f5c0c606c4a4361423f0b422ada5089cd92706
SHA3-384 hash: de03f8b3a4b06dad6d3eab26333c67b5babb54894ae599bf3f112356d26b2e33f2adefe4b9cfa855db3b866e37f34a1d
SHA1 hash: b6d97547536d63dde15a5dd035335e4fe6773d63
MD5 hash: 442298f22003093233e6991f02745b2e
humanhash: utah-earth-cat-fish
File name:SecuriteInfo.com.Win32.TrojanX-gen.4452.15781
Download: download sample
Signature AgentTesla
Create hunting rule
File size:642'048 bytes
First seen:2023-07-01 15:34:15 UTC
Last seen:2023-07-03 05:25:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:kRw4TDtT8LNz+Xnh2a1VyRgt4nKFUmJzppLNLveVlx7y:c98BywaqRgt80tJDNqVn
Threatray 199 similar samples on MalwareBazaar
TLSH T151D46C3C18BD6E27C075C2A58FE5C063B66498EF3521CB296BC3D795471AE0226C367E
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
303
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/404871/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.4452.15781.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Launching a process
Restart of the analyzed sample
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/64a047aa51710bcd8d43a911/reports/96f7afdf-2947-4604-be02-dd739d341890/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/24857c1d542e4013445cb7a2c9f5c0c606c4a4361423f0b422ada5089cd92706
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5bcc0d1d-0fa4-4a0f-bd8f-553cf804a024
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1264532
Signature
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 897562 Sample: SecuriteInfo.com.Win32.Troj... Startdate: 01/07/2023 Architecture: WINDOWS Score: 100 55 Snort IDS alert for network traffic 2->55 57 Found malware configuration 2->57 59 Sigma detected: Scheduled temp file as task from temp location 2->59 61 5 other signatures 2->61 7 SecuriteInfo.com.Win32.TrojanX-gen.4452.15781.exe 7 2->7         started        11 EkcWXBxGlpgd.exe 5 2->11         started        process3 file4 35 C:\Users\user\AppData\...kcWXBxGlpgd.exe, PE32 7->35 dropped 37 C:\Users\...kcWXBxGlpgd.exe:Zone.Identifier, ASCII 7->37 dropped 39 C:\Users\user\AppData\Local\...\tmpE367.tmp, XML 7->39 dropped 41 SecuriteInfo.com.W....4452.15781.exe.log, ASCII 7->41 dropped 63 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->63 65 May check the online IP address of the machine 7->65 67 Uses schtasks.exe or at.exe to add and modify task schedules 7->67 69 Adds a directory exclusion to Windows Defender 7->69 13 SecuriteInfo.com.Win32.TrojanX-gen.4452.15781.exe 15 2 7->13         started        17 powershell.exe 19 7->17         started        19 powershell.exe 21 7->19         started        21 schtasks.exe 1 7->21         started        71 Multi AV Scanner detection for dropped file 11->71 73 Machine Learning detection for dropped file 11->73 23 EkcWXBxGlpgd.exe 11->23         started        25 schtasks.exe 11->25         started        signatures5 process6 dnsIp7 43 exceltruea.com 162.241.27.28, 49717, 49718, 587 UNIFIEDLAYER-AS-1US United States 13->43 45 webmail.exceltruea.com 13->45 53 2 other IPs or domains 13->53 27 conhost.exe 17->27         started        29 conhost.exe 19->29         started        31 conhost.exe 21->31         started        47 webmail.exceltruea.com 23->47 49 104.237.62.211, 443, 49716 WEBNXUS United States 23->49 51 api.ipify.org 23->51 75 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 23->75 77 Tries to steal Mail credentials (via file / registry access) 23->77 79 Tries to harvest and steal browser information (history, passwords, etc) 23->79 33 conhost.exe 25->33         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/24857c1d542e4013445cb7a2c9f5c0c606c4a4361423f0b422ada5089cd92706/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-07-01 13:27:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
9 of 37 (24.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=escxyhkufzabgrc4w6rmt5oayydmjjbwcqr7bnbcvwsqrhgze4da._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
17b85440e830fbef06c68240cf0024dad39a394409980195c360c0084c4be907
AgentTesla
6ac53fdae8e1f8f64b9bdc321f0690935f29e26605451b268119cda2a41b6bda
AgentTesla
7d41acea98d4d6fcf0f2b213363211dd92645ef2694fdce56e61e81db5b2ba94
AgentTesla
8faf480c1ae966b6f4f2656368ec83dca9ab004811cf330083afc56043735a5b
AgentTesla
9e778ed10d6543b0b16f50bbb021181e2cd1d6e9ab230f28492eeb45838c3893
AgentTesla
b8affa2c64dd1a3661fd9ea46581ea09b733871562c2d080f2c81923e7275961
AgentTesla
ccc2705cc016a910af89b39b5beeca2885eedd714cca5ab153b416c201d0ea96
AgentTesla
cd917c86fe27ecd3feeca690377817bce1f4034830e6d68a19dbffc8c61e97bb
AgentTesla
d7a21a48d32ffe6331071b0c792603e0452cf6a1834afbd1167710d1416b6389
AgentTesla
d7b0e7f292354e86e9d8e57d99eb0430db5ea3ade7ebdb31e7186b3092136fe1
AgentTesla
+ 189 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230701-s1bvxaha44/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
1e2d5c6d0d1bd6b30e953d58f215bd7a6ad2da713c677ec2a17fa64bde7dd269
MD5 hash:
5067d421fa5787ed5509854a340cd163
SHA1 hash:
a7fe785f0499eef0ad823a494b29f83512c3620b
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
SH256 hash:
522a458f48e0ee93b7d50b95af4ede8bc64b2defd9622b80dfe10ef9e007ff31
MD5 hash:
56eed3d28fe95ac4893ce8420200e283
SHA1 hash:
47d446b7fca1320392f96a93c457fe3ba90d89ad
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
Parent samples :
24857c1d542e4013445cb7a2c9f5c0c606c4a4361423f0b422ada5089cd92706
73731e8949933a05500371755a699b7df164702af31515a8a6b17c04218d2319
8f07dc59ab491c482202ec6b44b84d6bcc7ba79f6bb571ffd8c9a139ab9da16b
2dde7c420d0f3055c38e0cbc7dae250fb319b3390a492784992bc9ae95af6d33
SH256 hash:
1e2d5c6d0d1bd6b30e953d58f215bd7a6ad2da713c677ec2a17fa64bde7dd269
MD5 hash:
5067d421fa5787ed5509854a340cd163
SHA1 hash:
a7fe785f0499eef0ad823a494b29f83512c3620b
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
SH256 hash:
522a458f48e0ee93b7d50b95af4ede8bc64b2defd9622b80dfe10ef9e007ff31
MD5 hash:
56eed3d28fe95ac4893ce8420200e283
SHA1 hash:
47d446b7fca1320392f96a93c457fe3ba90d89ad
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
Parent samples :
24857c1d542e4013445cb7a2c9f5c0c606c4a4361423f0b422ada5089cd92706
73731e8949933a05500371755a699b7df164702af31515a8a6b17c04218d2319
8f07dc59ab491c482202ec6b44b84d6bcc7ba79f6bb571ffd8c9a139ab9da16b
2dde7c420d0f3055c38e0cbc7dae250fb319b3390a492784992bc9ae95af6d33
SH256 hash:
1e2d5c6d0d1bd6b30e953d58f215bd7a6ad2da713c677ec2a17fa64bde7dd269
MD5 hash:
5067d421fa5787ed5509854a340cd163
SHA1 hash:
a7fe785f0499eef0ad823a494b29f83512c3620b
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
SH256 hash:
522a458f48e0ee93b7d50b95af4ede8bc64b2defd9622b80dfe10ef9e007ff31
MD5 hash:
56eed3d28fe95ac4893ce8420200e283
SHA1 hash:
47d446b7fca1320392f96a93c457fe3ba90d89ad
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
Parent samples :
24857c1d542e4013445cb7a2c9f5c0c606c4a4361423f0b422ada5089cd92706
73731e8949933a05500371755a699b7df164702af31515a8a6b17c04218d2319
8f07dc59ab491c482202ec6b44b84d6bcc7ba79f6bb571ffd8c9a139ab9da16b
2dde7c420d0f3055c38e0cbc7dae250fb319b3390a492784992bc9ae95af6d33
SH256 hash:
1e2d5c6d0d1bd6b30e953d58f215bd7a6ad2da713c677ec2a17fa64bde7dd269
MD5 hash:
5067d421fa5787ed5509854a340cd163
SHA1 hash:
a7fe785f0499eef0ad823a494b29f83512c3620b
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
SH256 hash:
522a458f48e0ee93b7d50b95af4ede8bc64b2defd9622b80dfe10ef9e007ff31
MD5 hash:
56eed3d28fe95ac4893ce8420200e283
SHA1 hash:
47d446b7fca1320392f96a93c457fe3ba90d89ad
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
Parent samples :
24857c1d542e4013445cb7a2c9f5c0c606c4a4361423f0b422ada5089cd92706
73731e8949933a05500371755a699b7df164702af31515a8a6b17c04218d2319
8f07dc59ab491c482202ec6b44b84d6bcc7ba79f6bb571ffd8c9a139ab9da16b
2dde7c420d0f3055c38e0cbc7dae250fb319b3390a492784992bc9ae95af6d33
SH256 hash:
24857c1d542e4013445cb7a2c9f5c0c606c4a4361423f0b422ada5089cd92706
MD5 hash:
442298f22003093233e6991f02745b2e
SHA1 hash:
b6d97547536d63dde15a5dd035335e4fe6773d63
Link:
https://www.unpac.me/results/9e106340-165c-42bb-ba9a-b0504da94f63/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/24857c1d542e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/24857c1d542e4013445cb7a2c9f5c0c606c4a4361423f0b422ada5089cd92706

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:msil_susp_obf_xorstringsnet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/404871/

Comments