MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 24bd41c8fc07f033063d6819f9b2ee788502332dccea8dacf1e944e5445e11b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 10
| SHA256 hash: | 24bd41c8fc07f033063d6819f9b2ee788502332dccea8dacf1e944e5445e11b1 |
|---|---|
| SHA3-384 hash: | 9071cb35ac57a8a9048e166b76677b745fae1624d3355ad97d8d8d9d6598663b2af206117232da391ab4dfbb72e5df74 |
| SHA1 hash: | 48d2d67ab6837c8601fb18cdd2d08adc11a731b2 |
| MD5 hash: | 2d3dde9676f824c437acd029df7b2d2d |
| humanhash: | cola-nebraska-north-alaska |
| File name: | Ziraat Bankası Swift Mesajı (8).exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 1'117'696 bytes |
| First seen: | 2023-03-09 13:08:51 UTC |
| Last seen: | 2023-03-09 14:29:14 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'642 x Formbook, 12'245 x SnakeKeylogger) |
| ssdeep | 24576:MuOZ6wGkB+e9uf8mS4WJOcfJcg3nsIXHXus2wnd8O:X+OcfJcg3RXHW+8O |
| Threatray | 1'516 similar samples on MalwareBazaar |
| TLSH | T1BF355A92E9995D5FE613CB3A5333580D21671D25F23DACE92C78F1A62AF26830721C37 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  abuse_ch |
| Tags: | AgentTesla exe geo TUR ZiraatBank |
Intelligence
File Origin
# of uploads :
2
# of downloads :
219
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Ziraat Bankası Swift Mesajı (8).exe
Verdict:
No threats detected
Analysis date:
2023-03-09 13:21:08 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-03-09 08:08:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
18 of 23 (78.26%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 1'506 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
b0b056b8e456d1a056bde5f134d8d2ec176949a0c3842488fa297ab8fa319c05
MD5 hash:
5c4afd35e8b7167fdade6c881bf1a04f
SHA1 hash:
df2de52b922c35beba2f8d15d9c09634af99dfab
SH256 hash:
6b739fd75d1fc59a528641bdf04fca35ca991627ffae39f0e2ef7304784ce13d
MD5 hash:
caf44fd31119d2a82a18878415e80645
SHA1 hash:
b96b7d3fe86cae362767addc380e7160aacadb70
SH256 hash:
57c9f486be687ebc08a756e5fd750fc63f3f3b8892b46508589ecfd2b69c9eca
MD5 hash:
cd7051e0594ee4d89521baffc7693b41
SHA1 hash:
9b7ee6f1bc68f29807b96c7487b12c751cff427b
SH256 hash:
1b257dab19deabeb2a99e6224f2394583fa2312f953555b461b25a7f66cd8c25
MD5 hash:
7c8f8352545a4f0de805d0afe3c30ad8
SHA1 hash:
46a998032407f5f7347a7da34eebebc41cf9b6ff
SH256 hash:
d01aa596af9a689f52bbf59da8d637833d796884047c12be54d0c00c65d72eae
MD5 hash:
1a9718c6fc99c0f80404a70acfafca61
SHA1 hash:
2449529452f01ce1f1998b4817463212e17b73e2
SH256 hash:
24bd41c8fc07f033063d6819f9b2ee788502332dccea8dacf1e944e5445e11b1
MD5 hash:
2d3dde9676f824c437acd029df7b2d2d
SHA1 hash:
48d2d67ab6837c8601fb18cdd2d08adc11a731b2
Malware family:
AgentTesla
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.