MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4168cb7280d51dff7f076d035d5233f5008af3ea643b8ceb89ccb9db1f9b601b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	4168cb7280d51dff7f076d035d5233f5008af3ea643b8ceb89ccb9db1f9b601b
SHA3-384 hash:	03487f3ae02281f4f2aa5ab301e2a4a6c9b361297d229820ac29cdb66fef800648bbbbd072d1d7ed79f575273e5ebcf6
SHA1 hash:	c08c2860fea7bb4c8676f12ff5e48a8fb31aad9b
MD5 hash:	c09fa3db9aff3bed3ac0dc27e541447a
humanhash:	coffee-three-papa-table
File name:	NEW P O.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	604'160 bytes
First seen:	2021-07-01 06:29:58 UTC
Last seen:	2021-07-01 07:57:35 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:uSs9tCtFV5QNs9Nqv8OaGp6k6xDs+LZD27kkF:vs3CtFjFspYx5tD
Threatray	6'249 similar samples on MalwareBazaar
TLSH	30D4122829F86266D7F76F7732E47155933DF7326B1ED12A2592030A46C3F40EDA2329
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

NEW P O.exe

Verdict:

Suspicious activity

Analysis date:

2021-07-01 06:33:19 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/030ef9b5-b860-42da-8374-e914d6e5ba0e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/169063/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.900.28234.28316.UNOFFICIAL

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/33a66675-71b3-4192-a850-e8276a13172a

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/810361

Signature

.NET source code contains very large array initializations

.NET source code contains very large strings

Allocates memory in foreign processes

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/4168cb7280d51dff7f076d035d5233f5008af3ea643b8ceb89ccb9db1f9b601b/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-07-01 02:33:39 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

8 of 46 (17.39%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ifumw4ua2uo767yhnubv2urt6uaiv47kmq5yz24jzs45wh43manq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

1f44c8727e54ebeac242dbb6b823672fb304a2e7b210002c7aaf061a5451c30a

AgentTesla

3262041b975c085ac4910cab0c54cafd02bee3accf8f921712f9a626634ea833

AgentTesla

49c52b95a4e8fb4790b5549c90a4f2bb7895693b1054d82074d66ca8fc5f8162

AgentTesla

4f332e317c5116e7c9b64ea8084a39aa4fff859a056ce9463557bdb0093eab55

AgentTesla

5ccb4b42592b867c638bc0b10bd75d11865ee1bea36d8242bffe1aba403336e4

AgentTesla

88f94c1e8a555d84bf7ad2e0fe21d82d33f1976786267af93808cc050d039bd9

AgentTesla

b1db9b45aa4903a5d9086d759765f4cb76a23e601c7bfd8133d440cace108307

AgentTesla

c050a7941b34bdcaf777425c5e17c279f7c9e92414cfbef866974bb4ea216fe8

AgentTesla

f077eba249e41b618f2beca6307585844eada56f528de4fa2468dce43a81fbda

AgentTesla

+ 6'239 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/210701-vlq48ks7vn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

AgentTesla Payload

AgentTesla

Unpacked files

SH256 hash:

d1d2749ff0dab6bb263ea0e98a9ba9c0ea0c1187f99926a96446d0da023a2571

MD5 hash:

8e48f627032f06547f304b2671629421

SHA1 hash:

8cbc21f04af3fd2001052b6957184075767f5723

Link:

https://www.unpac.me/results/1b2fa859-0a8b-4efd-848d-1f52cd77589e/

SH256 hash:

5bede9eedf6ae6df5a9d587c116c9583b31474c159c2b53486b000093cb3fde6

MD5 hash:

072eeac61b35d3f09edee4ff4f80f52d

SHA1 hash:

696fd9905a47e526470c2e234fef32f1ec1b74ad

Link:

https://www.unpac.me/results/1b2fa859-0a8b-4efd-848d-1f52cd77589e/

SH256 hash:

52f1f28cf6b0a20bf43c5da7f625ec179954aa3f0d0af24d5c4ca8ca8dfb85a8

MD5 hash:

92b8b0c8ddcd1bfbad803357c4286b4f

SHA1 hash:

41f56e0a44b66fd19c85c80cc5a355b17ff4e02a

Link:

https://www.unpac.me/results/1b2fa859-0a8b-4efd-848d-1f52cd77589e/

SH256 hash:

4168cb7280d51dff7f076d035d5233f5008af3ea643b8ceb89ccb9db1f9b601b

MD5 hash:

c09fa3db9aff3bed3ac0dc27e541447a

SHA1 hash:

c08c2860fea7bb4c8676f12ff5e48a8fb31aad9b

Link:

https://www.unpac.me/results/1b2fa859-0a8b-4efd-848d-1f52cd77589e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/4168cb7280d51dff7f076d035d5233f5008af3ea643b8ceb89ccb9db1f9b601b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.