MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 434a96eda6f4f679eabaf911cbd3e6fae660bbf5db67f7abdcc1aac4b4df44cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 20

Intelligence 20 IOCs YARA 11 File information Comments

SHA256 hash:	434a96eda6f4f679eabaf911cbd3e6fae660bbf5db67f7abdcc1aac4b4df44cf
SHA3-384 hash:	44255761029197303ae95ec023d7ab57aca62b37061403bfdc13fb2d14ca32ba60ac90388cbcac97d7818d4a1859d608
SHA1 hash:	4344c32c02017d14b0e92ca5e63910f1a3d23d69
MD5 hash:	0836b9cbbfe2e200cb8ef8f4fa95abf8
humanhash:	pip-romeo-cola-moon
File name:	434a96eda6f4f679eabaf911cbd3e6fae660bbf5db67f7abdcc1aac4b4df44cf.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	837'120 bytes
First seen:	2025-02-15 01:34:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	24576:fSuNvvEVdCEtYgILkXfDZOWk8ZAflmXtehn:frACEtYgJXlzUNCt
Threatray	4'649 similar samples on MalwareBazaar
TLSH	T158058CC4AA649702DC685BB09531DD3403BA3D6AB470F19E5ECA37D7B9BB3421928F07
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
File icon (PE):
dhash icon	0307612c88000000 (65 x AgentTesla, 47 x RemcosRAT, 9 x MassLogger)
Reporter	BastianHein
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

512

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

434a96eda6f4f679eabaf911cbd3e6fae660bbf5db67f7abdcc1aac4b4df44cf

Verdict:

Malicious activity

Analysis date:

2025-02-15 01:25:40 UTC

Tags:

stealer exfiltration agenttesla smtp

Link:

https://app.any.run/tasks/c54c671d-3e70-4ce3-80a6-96fa54d78fa1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67aff044a0fd713c335ada96

Tags:

agenttesla lien

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Searching for synchronization primitives

Creating a window

Creating a process with a hidden window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

Reading critical registry keys

Stealing user critical data

Adding an exclusion to Microsoft Defender

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

obfuscated obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/67afef54fc59120fe522b91b/reports/e5f4ff31-209e-409b-9262-d955f9b5378a/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/434a96eda6f4f679eabaf911cbd3e6fae660bbf5db67f7abdcc1aac4b4df44cf

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bd563fb7-948a-4663-b3cb-259c66b57ccc

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1615649

Signature

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/434a96eda6f4f679eabaf911cbd3e6fae660bbf5db67f7abdcc1aac4b4df44cf

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/434a96eda6f4f679eabaf911cbd3e6fae660bbf5db67f7abdcc1aac4b4df44cf/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2025-02-12 12:41:00 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=infjn3ng6t3ht2v27ei4xu7g7ltgbo7v3nt7pk64ygvmjng7ithq._file

Verdict:

malicious

Label(s):

unknown_loader_037

agenttesla

AgentTesla

4f6abf63121d8ac6db6af1b4aaa3331822ebf670bb70a98720d759cd41ec6a90

AgentTesla

6b6d63171af81a14bc15dc32c65b20ceade64462777a035f9eb04cf3b3f86be9

AgentTesla

8e410f45c665e8e5d2e5e690b37e232a596d3c975842a61fd9acf6f46161d7ca

AgentTesla

error

AgentTesla

f7cdea5cbabbed3fe3e137d50076ba977d6cc21490b350784bb4628a9914da40

AgentTesla

+ 4'639 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250215-bzvg7aspcv/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

AgentTesla

Agenttesla family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/2d007148-a3dd-4442-a2ab-4930c7605d8a

Unpacked files

SH256 hash:

434a96eda6f4f679eabaf911cbd3e6fae660bbf5db67f7abdcc1aac4b4df44cf

MD5 hash:

0836b9cbbfe2e200cb8ef8f4fa95abf8

SHA1 hash:

4344c32c02017d14b0e92ca5e63910f1a3d23d69

Link:

https://www.unpac.me/results/e66a4553-01ed-4dc3-b502-4e5e3a594863/

SH256 hash:

bf63d7998c512ebfaff4745b7536c583257ca145bf1a54dbca6b290c8c30b879

MD5 hash:

06ba662044c2b9eabeecc3b1ce80542e

SHA1 hash:

488b69b6a2adfa0422aea6824d25d3595a97412c

Detections:

AgentTeslaXorStringsNet

MSIL_SUSP_OBFUSC_XorStringsNet

INDICATOR_EXE_Packed_GEN01

Link:

https://www.unpac.me/results/e66a4553-01ed-4dc3-b502-4e5e3a594863/

Parent samples :

860c3c28fe9c4d8b7a334ea7df96b0e18d8cec439738c744b891a954160bbe1f
f211a840befa45cad5c369f64b91ff53d0dba7e98835dec3886ded59746e7333
4f6abf63121d8ac6db6af1b4aaa3331822ebf670bb70a98720d759cd41ec6a90
f7cdea5cbabbed3fe3e137d50076ba977d6cc21490b350784bb4628a9914da40
50a0786c77f3dde200940934383e97f756189a70865954f72c25ffa486240e78
8e410f45c665e8e5d2e5e690b37e232a596d3c975842a61fd9acf6f46161d7ca
7cbca9cdd19b58ec14154fad079c8aa568d509b385e5f19897b5bfc9647c5c82
804aee8eba800043c912038c55c36edeb8dd761913047e99b4a5e8d8cb8ef6c4
6b6d63171af81a14bc15dc32c65b20ceade64462777a035f9eb04cf3b3f86be9
434a96eda6f4f679eabaf911cbd3e6fae660bbf5db67f7abdcc1aac4b4df44cf
1fd01b430ccbb37347f138336cfecba2b6ac2c1eb2094a016588c448b092f7b3
3fdfd6e43f7328a408c2c5f27faf60cbf213f595c21cfd5b2fdd54170fcd2036

SH256 hash:

1079d53e6d09af2e72e954baff543dfb731a496b1b24869c07a6eeb8e152fb97

MD5 hash:

91179c377b0e8ff833a49bbcac0fa38c

SHA1 hash:

78c2f710043513a664b6a7b4d1e64e18616f0498

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/e66a4553-01ed-4dc3-b502-4e5e3a594863/

SH256 hash:

e712bcd56fe64742c0f674f3acff83490f8103c260ea3389f56151b5066b7cd3

MD5 hash:

7bad4197d1ae020c9049a782eb9a71d2

SHA1 hash:

e1253047ea92beb7d161b106765ad8b03bc86b1e

Link:

https://www.unpac.me/results/e66a4553-01ed-4dc3-b502-4e5e3a594863/

Malware family:

AgentTesla.v4

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/434a96eda6f4/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/434a96eda6f4f679eabaf911cbd3e6fae660bbf5db67f7abdcc1aac4b4df44cf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV4 Create hunting rule
Author:	kevoreilly
Description:	AgentTesla Payload

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	MSIL_SUSP_OBFUSC_XorStringsNet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:	https://github.com/dr4k0nia/yara-rules

Rule name:	msil_susp_obf_xorstringsnet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Windows_Trojan_AgentTesla_a2d69e48 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample