MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 450b711292c4325402ca90b7ac06436b80504482b37e223fb08465c7fb7e9d43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 14

Intelligence 14 IOCs YARA 2 File information Comments

SHA256 hash:	450b711292c4325402ca90b7ac06436b80504482b37e223fb08465c7fb7e9d43
SHA3-384 hash:	905017acfe0acce4c9413a9077b86e106787ce7b88318cf5e5ad948113abf1a3044c1bab01a9ec852b17303cd3c32f17
SHA1 hash:	6e61a35a348dcb791b19bb60cec93e121ae9dfdd
MD5 hash:	282c632ddfb9fd05c9fcd190948fa839
humanhash:	butter-july-single-sodium
File name:	SecuriteInfo.com.Win32.PWSX-gen.10825.24449
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'495'552 bytes
First seen:	2023-11-22 17:16:55 UTC
Last seen:	2023-11-23 21:27:26 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	24576:/vP1Kq4asSCBgwnX57tbTmjhD481VoYM6bXLwHv8FKVUe+PwRRcD+jFDXBys:/Eq4aIBfnJFSRGYJb0PEK3xRQ+p
TLSH	T10E65F1137DC1D2F4E0B90877C4E578284620B67A2C1F1C59D93AAE4DAE2BA5F09CF51E
TrID	30.2% (.EXE) Win64 Executable (generic) (10523/12/4) 18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 14.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 12.9% (.EXE) Win32 Executable (generic) (4505/5/1) 5.9% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	SecuriteInfoCom
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

346

Origin country :

Vendor Threat Intelligence

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/459740/

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.10825.24449.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Reading critical registry keys

DNS request

Creating a window

Stealing user critical data

Unauthorized injection to a system process

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/450b711292c4325402ca90b7ac06436b80504482b37e223fb08465c7fb7e9d43

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f0ada74e-ff40-4f69-8a5a-d2c13ad35238

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1346540

Signature

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/450b711292c4325402ca90b7ac06436b80504482b37e223fb08465c7fb7e9d43

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/450b711292c4325402ca90b7ac06436b80504482b37e223fb08465c7fb7e9d43/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-11-22 15:56:20 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

21 of 37 (56.76%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iufxceusyqzfiawksc32ybsdnoafarecwn7cep5qqrs4p636tvbq._file

Verdict:

malicious

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231122-vtn8rsee3y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

AgentTesla

Unpacked files

SH256 hash:

579ebc0c90fe82ea0c3c5f228f443576570f43ee3490d1299c2cbb467126dede

MD5 hash:

662786477a1d9a5586b9f3106430ea8b

SHA1 hash:

36dd8dc5158858377f04298abe28dd88938e6614

Link:

https://www.unpac.me/results/dbc8f726-0b3d-45b7-a88a-bf7154225301/

SH256 hash:

450b711292c4325402ca90b7ac06436b80504482b37e223fb08465c7fb7e9d43

MD5 hash:

282c632ddfb9fd05c9fcd190948fa839

SHA1 hash:

6e61a35a348dcb791b19bb60cec93e121ae9dfdd

Link:

https://www.unpac.me/results/dbc8f726-0b3d-45b7-a88a-bf7154225301/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/450b711292c4/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.98

Link:

https://yomi.yoroi.company/submissions/450b711292c4325402ca90b7ac06436b80504482b37e223fb08465c7fb7e9d43

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.