MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 431d5ac94ffcc12e9ff48e227ba286736ba47a50e6afd8f1ac2d9bf4a1b9fd33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 431d5ac94ffcc12e9ff48e227ba286736ba47a50e6afd8f1ac2d9bf4a1b9fd33
SHA3-384 hash: 63891fe8f3a3152372a2cc0cb2aca13787b9ee2f1e51061b50e111f6aa05c3ed33ed577884889981080fe5fb11e9090e
SHA1 hash: 68b7939873e7aba3112e6b51a3cfd2b8b43a2749
MD5 hash: 708be0d87c2de77618729c3c886e1d51
humanhash: monkey-venus-maryland-east
File name:708be0d87c2de77618729c3c886e1d51.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:809'472 bytes
First seen:2023-03-21 11:40:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:ie01vNe4sKsFWhjcn5vH2CQzagk1bMOn3qfjt1Q:iGaVhI56Ogk5Habt6
Threatray 1'541 similar samples on MalwareBazaar
TLSH T1F405016ABBA46A42C31E2A72C1E75530077158476773C7097EC916892A0E3E69C4FFCF
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
708be0d87c2de77618729c3c886e1d51.exe
Verdict:
Malicious activity
Analysis date:
2023-03-21 11:42:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/167a03b7-cc83-455b-9d0c-9b4278caed54

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/376241/
Detection(s):
Win.Trojan.NanoCore-9993885-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
80%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/641997d1b236355850d727ce/reports/6ba331d7-7f57-412d-b671-ae5c59d75fa5/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/431d5ac94ffcc12e9ff48e227ba286736ba47a50e6afd8f1ac2d9bf4a1b9fd33
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e5d0dcb2-20c8-4034-9ce7-247d4d1ff566
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1198484
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Installs a global keyboard hook
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/431d5ac94ffcc12e9ff48e227ba286736ba47a50e6afd8f1ac2d9bf4a1b9fd33/
Threat name:
ByteCode-MSIL.Trojan.DarkStealerLoader
Create hunting rule
Status:
Malicious
First seen:
2023-03-21 06:47:54 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
17 of 36 (47.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=imovvskp7tas5h7uryrhxiugonv2i6sq42x5r4nmfwn7jinz7uzq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
01d4c768eb131e8f7e2ffef8bc17f9ceb629ffdb3dd4a6364aaf8096bdd16161
AgentTesla
11113117a5262f41a4bbed276aec8faf760afaafbfd1c3c05e945aa1d3e911bd
AgentTesla
1e9b8c2056adf69d35b941a8514df02180ec6b2ff81ce8011023ba33ec2be203
AgentTesla
46febfcae87e38090f7309c95f66902659f252615b7b983cc5b0cda09cb57964
AgentTesla
7e0dd3b9557b18226181b4c0356499edd472030f975bcfc44a7fbfd56f7661a4
AgentTesla
9fe5448efcfb0a3d75204877140d9eeaa00ba0b84374742d1df5b03b6d41961e
AgentTesla
aced5165801c3fae21fb69b21d9dbaea768a5cc075186c660a81685ceba0dc1b
AgentTesla
c2f9b55d138def6ce13aee0438e44e97ea60199e1e707f57e42c625fb305764a
AgentTesla
c8ba5e51f81d3dd26cd602e11009877af2497585c8b6845724cc0d6a84fa539f
AgentTesla
+ 1'531 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230321-ntfhasaa74/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
8cfc0996884110fa6f72df26270f2a950ce77a98d2dd154bd908b3c42adb7202
MD5 hash:
bd2bdcb9f9154a5f35a5227dcf4a38da
SHA1 hash:
cf3e898048888738bd3502296069e46a5d5d3ffd
Link:
https://www.unpac.me/results/de06538c-10b0-4f0f-8dbd-7ad82ed7d737/
SH256 hash:
d06df7395d561e198f9b7c5481567116ff2e4c2e84437c018d2a2c8ea6c4ca37
MD5 hash:
0fb6061f7d37424fb9e6d0e76b019c19
SHA1 hash:
98a64bf7b459f032d6ec5793003bf61b5ae1dd74
Link:
https://www.unpac.me/results/de06538c-10b0-4f0f-8dbd-7ad82ed7d737/
Parent samples :
495607b1aef01bf7dfb64b5cb16a8fc0f161c2923627d71c69de97328f8eca3f
2434aa78b46a3afc98fa6e888c3eb56278ba52b0ff800e7e875af9c2e7f9011a
SH256 hash:
000c0889c2d93807781cb5e2c212d07bd38c6fed9b738530f2515640306b5f44
MD5 hash:
8d369299a047f228593293887092e43d
SHA1 hash:
7e38cd87127c3ea59ddba80f7ddf35fb105a7f6c
Link:
https://www.unpac.me/results/de06538c-10b0-4f0f-8dbd-7ad82ed7d737/
SH256 hash:
1b7b044d13fecc276cdded3076ebad9562a76415abebb2700b52af662415fc64
MD5 hash:
e4a446336699431d7f4ec2bf934acd54
SHA1 hash:
60ce9bb8c61f58ded21d9591bf52c42e6cbd930c
Link:
https://www.unpac.me/results/de06538c-10b0-4f0f-8dbd-7ad82ed7d737/
SH256 hash:
8fab7863aaeade212076786d3c4ce4d88dc920fbd140c483bcf01ba2fc1f2948
MD5 hash:
065bbccea1d58e9196f2b8683c4717f8
SHA1 hash:
587b9fb2dcff0728acec0fcdc941acd585755eee
Link:
https://www.unpac.me/results/de06538c-10b0-4f0f-8dbd-7ad82ed7d737/
SH256 hash:
65f2d98ab17c209d6e5546c548e60b073ed7e73c02e8d834fb382a12735f6ae6
MD5 hash:
6ae4aa9e917d85e16bbb08c97bfa3b9d
SHA1 hash:
31f781736d253e684d50f8c1085fecf96eef68a5
Link:
https://www.unpac.me/results/de06538c-10b0-4f0f-8dbd-7ad82ed7d737/
SH256 hash:
431d5ac94ffcc12e9ff48e227ba286736ba47a50e6afd8f1ac2d9bf4a1b9fd33
MD5 hash:
708be0d87c2de77618729c3c886e1d51
SHA1 hash:
68b7939873e7aba3112e6b51a3cfd2b8b43a2749
Link:
https://www.unpac.me/results/de06538c-10b0-4f0f-8dbd-7ad82ed7d737/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/431d5ac94ffc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Nanocore
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/431d5ac94ffcc12e9ff48e227ba286736ba47a50e6afd8f1ac2d9bf4a1b9fd33

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 431d5ac94ffcc12e9ff48e227ba286736ba47a50e6afd8f1ac2d9bf4a1b9fd33

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2556804/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/376241/

Comments