MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2974ae3c88a7395eb508e144a3efc57f2dd86be881396bf48b5db5463ada1d51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 19


Intelligence 19 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2974ae3c88a7395eb508e144a3efc57f2dd86be881396bf48b5db5463ada1d51
SHA3-384 hash: c8aa49b5453086516928ba9527d51b1b43417dcd36ae6d81384785b958e1f1ace521226a50bea229066bbbfb6b96ce82
SHA1 hash: f0cd56ef9fc05b7833585496bc49b4cc2deb3d61
MD5 hash: 1f314088a97934c47675c1c250a44ba2
humanhash: may-video-fruit-michigan
File name:Yehir Hastanesi scan00100_PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:825'344 bytes
First seen:2024-05-20 06:19:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:9ukmGjZtvexJcXxj7y8KL9v1P3q0qx/QSrxN5IC54TWMJA:8ujZR9j7uP3TqxVtgif
Threatray 11 similar samples on MalwareBazaar
TLSH T1A405221C467D4B31CE5ECA79DCEA16A40332A218F246FB1DEFC594DE6D23B258B42513
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon 83071f1713272b17 (7 x AgentTesla, 1 x RemcosRAT, 1 x PureLogsStealer)
Reporter abuse_ch
Tags:AgentTesla exe geo TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
329
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
2974ae3c88a7395eb508e144a3efc57f2dd86be881396bf48b5db5463ada1d51.exe
Verdict:
Malicious activity
Analysis date:
2024-05-20 06:27:44 UTC
Tags:
telegram exfiltration stealer agenttesla
Link:
https://app.any.run/tasks/0bb2404b-eeb7-4eba-a295-28e5640ea922

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Dropper.Formbook-10023016-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Tags:
Banker Encryption Execution Infostealer Network Enginenothandledtherequestintime Dexter
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Restart of the analyzed sample
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
comodo masquerade packed
Link:
https://www.filescan.io/uploads/664aeb96d7fb0506c93e2ee3/reports/5fd0e9d1-f4c6-4ed1-a958-7986d4f29f37/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/2974ae3c88a7395eb508e144a3efc57f2dd86be881396bf48b5db5463ada1d51
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/19c013f1-eb34-47a2-b8f1-84ed5c918058
Result
Threat name:
AgentTesla, PureLog Stealer, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1444132
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Moves itself to temp directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected PureLog Stealer
Yara detected Telegram RAT
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1444132 Sample: Yehir Hastanesi scan00100_PDF.exe Startdate: 20/05/2024 Architecture: WINDOWS Score: 100 45 api.telegram.org 2->45 49 Snort IDS alert for network traffic 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 57 18 other signatures 2->57 8 Yehir Hastanesi scan00100_PDF.exe 7 2->8         started        12 KpZGGG.exe 5 2->12         started        signatures3 55 Uses the Telegram API (likely for C&C communication) 45->55 process4 file5 39 C:\Users\user\AppData\Roaming\KpZGGG.exe, PE32 8->39 dropped 41 C:\Users\user\AppData\Local\...\tmp6E82.tmp, XML 8->41 dropped 59 Adds a directory exclusion to Windows Defender 8->59 61 Injects a PE file into a foreign processes 8->61 14 Yehir Hastanesi scan00100_PDF.exe 15 7 8->14         started        18 powershell.exe 23 8->18         started        20 powershell.exe 23 8->20         started        22 schtasks.exe 1 8->22         started        63 Antivirus detection for dropped file 12->63 65 Multi AV Scanner detection for dropped file 12->65 67 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->67 69 Machine Learning detection for dropped file 12->69 24 KpZGGG.exe 12->24         started        27 schtasks.exe 12->27         started        signatures6 process7 dnsIp8 47 api.telegram.org 149.154.167.220, 443, 49707, 49708 TELEGRAMRU United Kingdom 14->47 71 Moves itself to temp directory 14->71 73 Tries to steal Mail credentials (via file / registry access) 14->73 75 Installs a global keyboard hook 14->75 77 Loading BitLocker PowerShell Module 18->77 29 conhost.exe 18->29         started        31 WmiPrvSE.exe 18->31         started        33 conhost.exe 20->33         started        35 conhost.exe 22->35         started        43 C:\Users\user\AppData\...\tmpG308.tmp (copy), PE32 24->43 dropped 79 Tries to harvest and steal browser information (history, passwords, etc) 24->79 37 conhost.exe 27->37         started        file9 signatures10 process11
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2974ae3c88a7395eb508e144a3efc57f2dd86be881396bf48b5db5463ada1d51
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2974ae3c88a7395eb508e144a3efc57f2dd86be881396bf48b5db5463ada1d51/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-02-07 19:49:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ff2k4peiu44v5nii4fckh36fp4w5q27iqe4wx5ellw2umow2dviq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2974ae3c88a7395eb508e144a3efc57f2dd86be881396bf48b5db5463ada1d51
AgentTesla
2b99095636ec250358f5abd47474a374de96f743fc2fadb89642401301e6b670
AgentTesla
4b0d7d7932c2361c099955820fefc4636459c3ea3b155746fc04a7193d96e5b3
AgentTesla
b866026f749d4e1b366623e22811ca1e7b59c374fd8ec8b8078e06f19c179d51
AgentTesla
ed926217f9c0ac06a4349c5a3e2b0bbd8e8d162fc20cb6083a7f86457690af6b
AgentTesla
ffd8881c0f42c9d269430cd6ea2b9523be726a688a13a346389b1f4eebab68e8
AgentTesla
+ 1 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/240520-g3r45afc63/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3394d05c-1c3e-47aa-91b6-508162a8059f
Unpacked files
SH256 hash:
8420ffe6a3608f74785f79a4892c996015fcd4bcecd17e22fcd47bb6ae863c96
MD5 hash:
4f278daa234297a4824f2b4b8add06e0
SHA1 hash:
f53a8d43d7f14eb9684090634c92f9a83d63e152
Link:
https://www.unpac.me/results/e230f774-4c36-49e3-b82e-368ccaf3c351/
SH256 hash:
6384dabeffdc0afc3d7f1e18d0033e7482790c0aa2f1f2af7cc39eb81795d0ef
MD5 hash:
f759d70f3bbee3865d9ba45b70c59bea
SHA1 hash:
f07ca29866cf8b0d92f18904860c40a284a5f550
Detections:
INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/e230f774-4c36-49e3-b82e-368ccaf3c351/
SH256 hash:
10fbf76f5b6f715fc3c136103b5e4b757d184fd2b77d64fc5304c36eaea063d1
MD5 hash:
6894612b52ce435495ea7e5ee9415add
SHA1 hash:
bd772aaee326db17ff27df0359f77c8091c2914a
Detections:
AgentTesla
Create hunting rule
MALWARE_Win_AgentTeslaV3
Create hunting rule
Link:
https://www.unpac.me/results/e230f774-4c36-49e3-b82e-368ccaf3c351/
Parent samples :
025a8321c88613c46fdd67037840f52968d82f623653d56baf67799ebf830611
f2d1383495b3d3b154505fbb97ddb06c01c100d30f7828e71a032db0acbc4a26
08147a0de0bb290829a48536b659527ee1a3c6017df1d1d911f79fd76c0ff859
430b243c159c1263e0dec6b0f332193351d15e723c5d413dadca8c240107f6da
76a2ccfcef756d91adaa6ee5e31af66c87daf0f35062b1e081c25d41aee44f3a
bf670829499b37ad382f284f9dfdcc58df3862f419f070b0c13ec3377f0dfb88
f030a4a82db3734a227b011d76767f6f8b9031ea4666aff7b42d8e0d69d6acea
6f0c010a3563a788cef8ac63c83c7c4f41c5a5834cccf80a907de0216cbc003b
506e064c3d6d2932d75e5209e848eb989c8790eccf85d96001d809234560cbd6
c7f0e4ce6d95ce821671196d361bcd2eb1ac9f6837fd4693968fda7b4f926eac
99f8b58cc35942ee1263c39d53425a6317ca0ded571c82539398e7f1822d20c4
24c69122ace7d707b1838376111192f2bcdbd02531521b656536773b8bc4710c
8048311a5b5bd201679951dc13b0e8d156010f37dda2ceb0396b703fa4ff38c3
5762d98de35eb91afb9d86bad2f0c88e31732dffe13f187667b43a66e33f7e07
3a6d7351d110df11fde83df14b50d25a56ac64ec89dcf19fe093d96557058360
856c8bb75c2b8c79b99f9249c201d20838251a94a4f830afa7995a3af0952842
8b5fdd54d03568aa937bc3e4bebb8972f40860192f38348e0cd97f61f8ab00f7
b9fc651bcd9745a7fe9aafe13a13e3280f22aa10a50a6b54edc908f783f5fdcf
c34595b336cffa1c3c6cf48b44a4a988c213e882a647bef9f887fc6c3a3fd51b
320c4584c3d392006ef443e5743123a45909fbae309c7561ced8fac11e11e5d3
91ae2bc0f6faac51d7cd9c8c8edf0a2d4bfb5e16c3c4e3c221ff4d50925cfd7d
c0d2175379d5613de7a562df8a96a3aa3a9c1b740380aa4a43026a534fc39ef9
34c9273e2941aa8a91c0d15c86799e87a8d3bd39dd16d90c8df3421ac014a10b
f84d789635e636040055b6e95077408820a412d66bb66934112a004ac24d9eba
a5e39f16cb3dec0b3e2b6fe876bbfa1805f2266011289cf24864b3b85d9e5561
b2eb42a73b2d0577b927a7e2f287262116d8b0962e975d66ae7c1f2dc50626a2
744d97984aa09fc2b01b43e56e0c76705031f79a4007e1ea88251b6dde4ccf76
9f6374c06e596c5507f375bd2f58e0cb52ecfeb47a2edaf3171456f5c6cc9552
a4a24aead00b96a54acdbaa7566f511561c7eb1ca918bdfa8e92a6380e0199aa
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
2974ae3c88a7395eb508e144a3efc57f2dd86be881396bf48b5db5463ada1d51
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
11be7cf9279c9dd3f8584bfafe98ed1aae2d278d3a1e2009203dbac56967cc99
SH256 hash:
795cf70b9cf814b3aed6932c2f661a2e4725fd71bde5365c6893a05297251557
MD5 hash:
73f76a231c3db47d97860a8f11b898d7
SHA1 hash:
2086f18b34e588c831a387193d99758e49f9d32d
Link:
https://www.unpac.me/results/e230f774-4c36-49e3-b82e-368ccaf3c351/
SH256 hash:
8f0c7e3047346b8d6477ff6d4639fd6157602c7ebc840f3432b99263f1cb415c
MD5 hash:
e5b073b30db1b058298f5df032164e4d
SHA1 hash:
15d3ada4e7ac01b766615b9b66785e7e2ae9b0ca
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/e230f774-4c36-49e3-b82e-368ccaf3c351/
SH256 hash:
2974ae3c88a7395eb508e144a3efc57f2dd86be881396bf48b5db5463ada1d51
MD5 hash:
1f314088a97934c47675c1c250a44ba2
SHA1 hash:
f0cd56ef9fc05b7833585496bc49b4cc2deb3d61
Link:
https://www.unpac.me/results/e230f774-4c36-49e3-b82e-368ccaf3c351/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2974ae3c88a7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2974ae3c88a7395eb508e144a3efc57f2dd86be881396bf48b5db5463ada1d51

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments