MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ad65e78905204a2813c619cd38632eeb99e111b5246dfb34558813ad442136e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ad65e78905204a2813c619cd38632eeb99e111b5246dfb34558813ad442136e
SHA3-384 hash: 0422b3808dc6e0a5063e89884fb6a187c8ed3690c6be9b131a983ece23a973ff870c1525cf30b0142d5a3782c5f78d00
SHA1 hash: 9bc6f65b0f32d27f8d6b37c19e4d14e2137fa500
MD5 hash: 09ce74d3a20e7079fce012b44c7b2f0b
humanhash: sad-sixteen-golf-fourteen
File name:SecuriteInfo.com.Trojan.Siggen21.731.29519.27180
Download: download sample
Signature AgentTesla
Create hunting rule
File size:656'896 bytes
First seen:2023-06-26 13:31:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:95dPG2fjGWuQlyobkkEmeKD2/OHzTJGa2v+DF/JlF2ny9EW4ZFhP:DjREsbDy6v90ZT
Threatray 4'116 similar samples on MalwareBazaar
TLSH T1BCD4363839BD5227D074D7E78FE7F023B278986B3021EA2568C657D90686F1225C763E
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
289
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Trojan.Siggen21.731.29519.27180
Verdict:
Malicious activity
Analysis date:
2023-06-26 13:31:45 UTC
Tags:
agenttesla
Link:
https://app.any.run/tasks/2feb9037-102d-4c56-8d9b-de22bd4b5a10

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/402983/
Detection(s):
SecuriteInfo.com.Trojan.Siggen21.731.29519.27180.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64999354ee55f1e1b4b59517/reports/4187e106-cd0d-4f24-9566-f195ba0ac39e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/2ad65e78905204a2813c619cd38632eeb99e111b5246dfb34558813ad442136e
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/92baf4e8-f7ac-4b7f-94e9-95cf65e61843
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1261478
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ad65e78905204a2813c619cd38632eeb99e111b5246dfb34558813ad442136e/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-06-26 12:09:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
19 of 24 (79.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fllf46eqkickfaj4mgonhbrs524z4ei3kjdn7m2flcatvvcccnxa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
05b9b2ba7cef56b08f7d979f09119528e4de33b6165599c5f550b8c3c7a3f9d2
AgentTesla
1a6889803b766ce102a10973126f946e3618a0f80c1cee6d902304d2ffae06c5
AgentTesla
3520f6322123eacd232b1dd107d892e852aa8cfa79eaf4fc3fb9c5b23893c948
AgentTesla
38b7e813402447704258ca274ea142fc05f52da70913bbd3d31392a855287f8e
AgentTesla
511bd4f1051444242dda8ae6df80720106a6b4d60eab89658baffb142affe730
AgentTesla
54b8c91ae0485d795f9821b01eb839bd682aee18df6a0b54d14d6eb2a2c0e83d
AgentTesla
816dcc8bb5070ed2db687bdb064a383c946c8183f5e0c089f2453653be8a3086
AgentTesla
e2a4e3661a1ba5c88dbfcb792f0d489b37f14f74f2d1b2111a278bc81fb930c7
AgentTesla
+ 4'106 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230626-qsyctsag7y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
06e44eb62b4753358282740eabed3923fd9096cfa7e331168ea9cd65814b00dc
MD5 hash:
a65de5afa1656ec14ff79b1fad54df4f
SHA1 hash:
f058b063579c26f0da1cc05a3fb1e794a2aa17e9
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
29490ecd72d223998116aa04b8a762382a1f35f9f90db1809bd3dc06cf9d3e31
MD5 hash:
87d9cef7e30f4db3312e8583e1080750
SHA1 hash:
c2515f9687f287039a633fb7981f5c4d73e6d25c
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
06e44eb62b4753358282740eabed3923fd9096cfa7e331168ea9cd65814b00dc
MD5 hash:
a65de5afa1656ec14ff79b1fad54df4f
SHA1 hash:
f058b063579c26f0da1cc05a3fb1e794a2aa17e9
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
29490ecd72d223998116aa04b8a762382a1f35f9f90db1809bd3dc06cf9d3e31
MD5 hash:
87d9cef7e30f4db3312e8583e1080750
SHA1 hash:
c2515f9687f287039a633fb7981f5c4d73e6d25c
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
06e44eb62b4753358282740eabed3923fd9096cfa7e331168ea9cd65814b00dc
MD5 hash:
a65de5afa1656ec14ff79b1fad54df4f
SHA1 hash:
f058b063579c26f0da1cc05a3fb1e794a2aa17e9
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
06e44eb62b4753358282740eabed3923fd9096cfa7e331168ea9cd65814b00dc
MD5 hash:
a65de5afa1656ec14ff79b1fad54df4f
SHA1 hash:
f058b063579c26f0da1cc05a3fb1e794a2aa17e9
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
29490ecd72d223998116aa04b8a762382a1f35f9f90db1809bd3dc06cf9d3e31
MD5 hash:
87d9cef7e30f4db3312e8583e1080750
SHA1 hash:
c2515f9687f287039a633fb7981f5c4d73e6d25c
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
29490ecd72d223998116aa04b8a762382a1f35f9f90db1809bd3dc06cf9d3e31
MD5 hash:
87d9cef7e30f4db3312e8583e1080750
SHA1 hash:
c2515f9687f287039a633fb7981f5c4d73e6d25c
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
SH256 hash:
2ad65e78905204a2813c619cd38632eeb99e111b5246dfb34558813ad442136e
MD5 hash:
09ce74d3a20e7079fce012b44c7b2f0b
SHA1 hash:
9bc6f65b0f32d27f8d6b37c19e4d14e2137fa500
Link:
https://www.unpac.me/results/74531441-780b-44f9-8697-01ec5450647d/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2ad65e789052/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2ad65e78905204a2813c619cd38632eeb99e111b5246dfb34558813ad442136e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/402983/

Comments