MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24c73577bbb03f99481ddb147930b9289482627c423c816438cfa1eaca58347e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24c73577bbb03f99481ddb147930b9289482627c423c816438cfa1eaca58347e
SHA3-384 hash: 751afcfa886c45153da93d640017fef165ae904bf61cf6154f097d4bea175a9dbfe43c9a3109cb06966c714ff68c13c6
SHA1 hash: 36b2c90850b65ce06285e0c629c2f7fa077b2865
MD5 hash: 97de6669ef181ef42ab34e20b3a63a7f
humanhash: aspen-fanta-moon-indigo
File name:SecuriteInfo.com.Win32.PWSX-gen.21369.13762
Download: download sample
Signature AgentTesla
Create hunting rule
File size:839'168 bytes
First seen:2023-06-25 23:35:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:S6/hU5WRQeaNvEhlZeQkR4nSxUEMvBv8Mc/7nc4GqzrRN:S23zZeQkR4nkUd2GOVN
Threatray 4'136 similar samples on MalwareBazaar
TLSH T14A0594BD298C76A79575D99F4DE1054BF23B7322B7138DA826D212C1C62261E37ECC0E
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
319
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.21369.13762
Verdict:
Malicious activity
Analysis date:
2023-06-25 23:37:28 UTC
Tags:
agenttesla rat
Link:
https://app.any.run/tasks/9e8cf7d5-3990-43e2-92ab-f1a21d180ffc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/402724/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.21369.13762.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6498cf63942dd42877babc4e/reports/fbac1199-cb99-487e-b773-2bc23badfbdf/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/24c73577bbb03f99481ddb147930b9289482627c423c816438cfa1eaca58347e
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/59717e6d-f073-46b4-9482-d5f7c2325021
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1261162
Signature
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/24c73577bbb03f99481ddb147930b9289482627c423c816438cfa1eaca58347e/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-06-25 21:33:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
21 of 37 (56.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=etdtk553wa7zssa53mkhsmfzfckieyt4ii6iczbyz6q6vssygr7a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1e5492854f8e9e427a594ac5938e7a798e084f7bc960a62fdfa076e3f929de57
AgentTesla
22f78673c87c878a5be8e407f697613d8b1dd28f08a2419e8be224fabc3f02ea
AgentTesla
2350cd7baba805daf4c4216695cad848c3df79edd54e23aea3f953c33572c65d
AgentTesla
46b4b2389f1560cd54de61d97335027c5ea7d8967b16c328d456927bc58538fe
AgentTesla
5453c16d0530e3bf32f870269a92db07188195005273c769b05752f4bb7c18e1
AgentTesla
8cb05af5d5848832ac7006071a842f3566196a891cd232ff3602b550803e73c5
AgentTesla
a7880f86bd0bbb436dde37febb6168a0fbc51978378c0f5fd8f024d3c6487a7c
AgentTesla
ae1d10a430aed6814f985efb49cca0a27402e8c32653a7864a48b706c4f9a03b
AgentTesla
fb40e17851858fbbec34c25bdcbe95780011fe11cbda99334b17852768cfcad2
AgentTesla
fc54140655e3660dc45f2582c9fa41f4f957b22f86375e7c3ca723d28004d8f2
AgentTesla
+ 4'126 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230625-3ljx3seh58/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
AgentTesla
Unpacked files
SH256 hash:
e9457d533e370f3ebf090fa2d9da5de239fd5ae7a9ea653fdbc5a0f2df405c40
MD5 hash:
a77140618dbf6a2f03b3985c5a16efd9
SHA1 hash:
625f982e5835b34f75e999156a3cdc18dd6d3bb0
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/fd3bc058-44b0-45ce-8519-99de54a7175f/
Parent samples :
24c73577bbb03f99481ddb147930b9289482627c423c816438cfa1eaca58347e
25277f616af1f7335329651071b68e7c202f7cf32896ab437cabe5a32c760a9e
5fb756286d572b94dac56ac37ef20f096fbb55f058b6c5189f79d88e7a6bbc6b
SH256 hash:
22081c1a650b543e6d8c8b2af11816c4b96689365ba4dc4043dcd823a89cf7bf
MD5 hash:
8a9f143899513037684e2661669c7e4c
SHA1 hash:
2bff9eefb4a6cebdeaa80a6ae9afbc3367dcf834
Link:
https://www.unpac.me/results/fd3bc058-44b0-45ce-8519-99de54a7175f/
SH256 hash:
ad77d87954f4cd8fe670ea91a3988a2d1c89f5da1a4590289d9ad46f33d0deca
MD5 hash:
5167df203a55e5519ea003fa1d004c37
SHA1 hash:
08445aa282b89b76bd2aa2b8b663864263d16be8
Link:
https://www.unpac.me/results/fd3bc058-44b0-45ce-8519-99de54a7175f/
SH256 hash:
e9457d533e370f3ebf090fa2d9da5de239fd5ae7a9ea653fdbc5a0f2df405c40
MD5 hash:
a77140618dbf6a2f03b3985c5a16efd9
SHA1 hash:
625f982e5835b34f75e999156a3cdc18dd6d3bb0
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/fd3bc058-44b0-45ce-8519-99de54a7175f/
Parent samples :
24c73577bbb03f99481ddb147930b9289482627c423c816438cfa1eaca58347e
25277f616af1f7335329651071b68e7c202f7cf32896ab437cabe5a32c760a9e
5fb756286d572b94dac56ac37ef20f096fbb55f058b6c5189f79d88e7a6bbc6b
SH256 hash:
22081c1a650b543e6d8c8b2af11816c4b96689365ba4dc4043dcd823a89cf7bf
MD5 hash:
8a9f143899513037684e2661669c7e4c
SHA1 hash:
2bff9eefb4a6cebdeaa80a6ae9afbc3367dcf834
Link:
https://www.unpac.me/results/fd3bc058-44b0-45ce-8519-99de54a7175f/
SH256 hash:
ad77d87954f4cd8fe670ea91a3988a2d1c89f5da1a4590289d9ad46f33d0deca
MD5 hash:
5167df203a55e5519ea003fa1d004c37
SHA1 hash:
08445aa282b89b76bd2aa2b8b663864263d16be8
Link:
https://www.unpac.me/results/fd3bc058-44b0-45ce-8519-99de54a7175f/
SH256 hash:
e9457d533e370f3ebf090fa2d9da5de239fd5ae7a9ea653fdbc5a0f2df405c40
MD5 hash:
a77140618dbf6a2f03b3985c5a16efd9
SHA1 hash:
625f982e5835b34f75e999156a3cdc18dd6d3bb0
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/fd3bc058-44b0-45ce-8519-99de54a7175f/
Parent samples :
24c73577bbb03f99481ddb147930b9289482627c423c816438cfa1eaca58347e
25277f616af1f7335329651071b68e7c202f7cf32896ab437cabe5a32c760a9e
5fb756286d572b94dac56ac37ef20f096fbb55f058b6c5189f79d88e7a6bbc6b
SH256 hash:
22081c1a650b543e6d8c8b2af11816c4b96689365ba4dc4043dcd823a89cf7bf
MD5 hash:
8a9f143899513037684e2661669c7e4c
SHA1 hash:
2bff9eefb4a6cebdeaa80a6ae9afbc3367dcf834
Link:
https://www.unpac.me/results/fd3bc058-44b0-45ce-8519-99de54a7175f/
SH256 hash:
ad77d87954f4cd8fe670ea91a3988a2d1c89f5da1a4590289d9ad46f33d0deca
MD5 hash:
5167df203a55e5519ea003fa1d004c37
SHA1 hash:
08445aa282b89b76bd2aa2b8b663864263d16be8
Link:
https://www.unpac.me/results/fd3bc058-44b0-45ce-8519-99de54a7175f/
SH256 hash:
24c73577bbb03f99481ddb147930b9289482627c423c816438cfa1eaca58347e
MD5 hash:
97de6669ef181ef42ab34e20b3a63a7f
SHA1 hash:
36b2c90850b65ce06285e0c629c2f7fa077b2865
Link:
https://www.unpac.me/results/fd3bc058-44b0-45ce-8519-99de54a7175f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/24c73577bbb03f99481ddb147930b9289482627c423c816438cfa1eaca58347e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/402724/

Comments