MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4343245f1db76214093c4adefb0b167327c7bd49fa66608eccb2c4faadc3e32d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 18


Intelligence 18 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4343245f1db76214093c4adefb0b167327c7bd49fa66608eccb2c4faadc3e32d
SHA3-384 hash: 4894464b0b63c814a0bd3a209bec825bc6b3360c612d1b0065d5214a0f56d6fd9994ad6697c2d24ef7d4cc955ce50c1d
SHA1 hash: e11fd30e973f1017441d7c8ea8f0bbc2b24428a7
MD5 hash: a119383584e80da3de3c9e13ea0fd8a4
humanhash: oregon-don-iowa-timing
File name:TT copy for EUR 87000img.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:751'104 bytes
First seen:2023-10-11 13:21:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:ReX9Kk/xdXfJ4kauYc6F3TVw8EIvvaCrHBW1QbFN2Y6aHJEbrK:Retj//Pqru56F3ZwPW92/K
Threatray 205 similar samples on MalwareBazaar
TLSH T17CF4012432E89B66F2BE5BF64174120207F5652735BAE3AC9FE014CF6F61F818514BA3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
308
Origin country :
US US
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
TT copy for EUR 87000img.exe
Verdict:
Malicious activity
Analysis date:
2023-10-11 13:24:19 UTC
Tags:
stealer agenttesla
Link:
https://app.any.run/tasks/94a50f12-1f8b-4319-a394-7673a6f49183

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/453256/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2370.32145.9752.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6526a17bbe42b2ac8e634eef/reports/d1cc563f-6ff3-4d0d-93f7-96070d756aa0/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4343245f1db76214093c4adefb0b167327c7bd49fa66608eccb2c4faadc3e32d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fd897f3e-29f8-4438-864e-1b3f2a5b167b
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1323741
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Schedule system process
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1323741 Sample: TT_copy_for_EUR_87000img.exe Startdate: 11/10/2023 Architecture: WINDOWS Score: 100 44 cp5ua.hyperhost.ua 2->44 48 Found malware configuration 2->48 50 Sigma detected: Scheduled temp file as task from temp location 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 8 other signatures 2->54 8 ZyenHlZSmSS.exe 4 2->8         started        11 TT_copy_for_EUR_87000img.exe 6 2->11         started        signatures3 process4 file5 56 Multi AV Scanner detection for dropped file 8->56 58 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->58 60 Machine Learning detection for dropped file 8->60 62 Injects a PE file into a foreign processes 8->62 14 ZyenHlZSmSS.exe 8->14         started        17 schtasks.exe 8->17         started        19 ZyenHlZSmSS.exe 8->19         started        21 ZyenHlZSmSS.exe 8->21         started        40 C:\Users\user\AppData\...\ZyenHlZSmSS.exe, PE32 11->40 dropped 42 C:\Users\user\AppData\Local\...\tmp2B88.tmp, XML 11->42 dropped 64 Uses schtasks.exe or at.exe to add and modify task schedules 11->64 66 Adds a directory exclusion to Windows Defender 11->66 23 TT_copy_for_EUR_87000img.exe 2 11->23         started        26 powershell.exe 23 11->26         started        28 powershell.exe 23 11->28         started        30 2 other processes 11->30 signatures6 process7 dnsIp8 68 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->68 70 Tries to steal Mail credentials (via file / registry access) 14->70 72 Tries to harvest and steal browser information (history, passwords, etc) 14->72 32 conhost.exe 17->32         started        46 cp5ua.hyperhost.ua 91.235.128.141, 49712, 49713, 49714 ITLASUA Ukraine 23->46 34 conhost.exe 26->34         started        36 conhost.exe 28->36         started        38 conhost.exe 30->38         started        signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4343245f1db76214093c4adefb0b167327c7bd49fa66608eccb2c4faadc3e32d/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-10-11 10:54:57 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
9 of 38 (23.68%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=inbsixy5w5rbicj4jlppwcywomt4ppkj7jtgbdwmwlcpvlod4mwq._file
Verdict:
malicious
Similar samples:
1c5bb4c35c028b3a21251f3c15428e43b1726d14768aa72766467a5fd78781a9
AgentTesla
1c6b0eb5c224c46a65fb5022852905a1293a148bd97bb81593b813e8ed814ba8
AgentTesla
799e36ff1695259d24c06e331c23a941146e805b2502b35208fbff613424d3b6
AgentTesla
b93fab56242eb11d31992191aa2a57f93c8f9b77d1041b4c97e830f2b4ff5045
AgentTesla
d2355e84bd9dff1872c5bf04051c3984de36958b0af97c1ad874bce663501399
AgentTesla
d90d513c0b6637bdf60e17b2dba7803699a370b816910116496ad827eb82656b
AgentTesla
db19c9886fae3d7d0b1fa2afe5918fec9e993b31775d8520a523dc9653fcbad8
AgentTesla
e2f7fb5aad34116772b8667f4b40002ad59a5f81516b66c1ce9c5874f089ce6d
AgentTesla
f5bf96b8b4dbcaefb28de614a310a78b5abf3f61d97efdf1f446ab3acf0a373e
AgentTesla
+ 195 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/231011-ql79fsbd73/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
a040efb5ce92995b5d40fd2536c8ad6a93f2d8584a3dd52f07cdb0b34c9e6e29
MD5 hash:
a5a52675690de850e3de6c05a9bd885f
SHA1 hash:
fd953edf2e910fbb43c9e6d4c8d48632bb4e55c6
Link:
https://www.unpac.me/results/68ac83c7-a365-4c98-8b01-a4080715500e/
SH256 hash:
83504e4957b6a912f212206d84c5a30c8878ff864359700e69f73586c19cc098
MD5 hash:
3503951190f52faa6b1e6860b82e0f3b
SHA1 hash:
eb5ebba6411b525114ee1fa1ede005bf6a3b70f8
Link:
https://www.unpac.me/results/68ac83c7-a365-4c98-8b01-a4080715500e/
SH256 hash:
24a1aaa74ac735f70576758eaf5df6eef7bde676e309acc5e3d1c710ce6fd6ab
MD5 hash:
3786b8e890b4b1947b94f2392b50dd4b
SHA1 hash:
719e47b38ffe0f53abbeb855f62f1e785d86b74e
Link:
https://www.unpac.me/results/68ac83c7-a365-4c98-8b01-a4080715500e/
SH256 hash:
5cfbb86f2c5ac2f2d208c936cd753a9df580d2e07c7cdf81c756a949cf9909f9
MD5 hash:
6208e5de4bcc2fe4ba3df6409e19c076
SHA1 hash:
47467886d1b87c204106c85d8268450c21238fdf
Detections:
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/68ac83c7-a365-4c98-8b01-a4080715500e/
Parent samples :
4343245f1db76214093c4adefb0b167327c7bd49fa66608eccb2c4faadc3e32d
f566666ec884f4fb52f5167294dfce5402e8bb78ed4cd242985492312eaa4a66
SH256 hash:
4343245f1db76214093c4adefb0b167327c7bd49fa66608eccb2c4faadc3e32d
MD5 hash:
a119383584e80da3de3c9e13ea0fd8a4
SHA1 hash:
e11fd30e973f1017441d7c8ea8f0bbc2b24428a7
Link:
https://www.unpac.me/results/68ac83c7-a365-4c98-8b01-a4080715500e/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4343245f1db7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4343245f1db76214093c4adefb0b167327c7bd49fa66608eccb2c4faadc3e32d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/453256/

Comments