MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 485b45513f839ff3c972cbd2434273388b87c070c8c6125a8462aeabe2fb96d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 485b45513f839ff3c972cbd2434273388b87c070c8c6125a8462aeabe2fb96d5
SHA3-384 hash: ee0d6535d4f348d7f3c12b3bea66c30672cd759f68a26c6189c204be0a3ca3ca49754db1ea0af90aa6056ce2eeb6889a
SHA1 hash: 360dde23757e8eacd3ce7beebdaf9323bae070ad
MD5 hash: 24064073cb8d91a8ae77aee762ef1c1d
humanhash: sweet-uranus-wyoming-river
File name:24064073cb8d91a8ae77aee762ef1c1d
Download: download sample
Signature AgentTesla
Create hunting rule
File size:750'080 bytes
First seen:2023-07-31 07:20:23 UTC
Last seen:2023-07-31 12:49:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:G9gjjTS0yzzJ5xuJONZKz2QFIo5N+rLjywhhE2rl9EfwkgDHI:G9gjjO0yz95wJpz25aNJ6Dp4wk
Threatray 5'412 similar samples on MalwareBazaar
TLSH T198F4F152F1681FA7C43687F90826D10427BAB76A203DD7592DF278CB11B6FD10A46F2B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter zbetcheckin
Tags:32 AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
274
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
DRFT BL.docx
Verdict:
Malicious activity
Analysis date:
2023-07-31 06:33:10 UTC
Tags:
exploit cve-2017-11882 loader stealer agenttesla
Link:
https://app.any.run/tasks/63d655bc-71a5-4b61-b24a-1d02d41aba75

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/439342/
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.102199.747.8763.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.GenericKDZ.102199.12764.32320.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed remcos
Link:
https://www.filescan.io/uploads/64c760de2e037e88653f257e/reports/8db56e74-fb6a-4f35-b691-f1ba0ecacc06/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/485b45513f839ff3c972cbd2434273388b87c070c8c6125a8462aeabe2fb96d5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/40ed3626-efe5-4dff-8d72-c0d4747183a8
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1283022
Signature
.NET source code contains potential unpacker
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1283022 Sample: B8aSecXA3i.exe Startdate: 31/07/2023 Architecture: WINDOWS Score: 100 53 Found malware configuration 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 Yara detected AgentTesla 2->57 59 3 other signatures 2->59 6 B8aSecXA3i.exe 3 2->6         started        10 oRNbc.exe 3 2->10         started        12 oRNbc.exe 2 2->12         started        process3 file4 23 C:\Users\user\AppData\...\B8aSecXA3i.exe.log, ASCII 6->23 dropped 61 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->61 63 May check the online IP address of the machine 6->63 65 Injects a PE file into a foreign processes 6->65 14 B8aSecXA3i.exe 17 5 6->14         started        67 Multi AV Scanner detection for dropped file 10->67 69 Machine Learning detection for dropped file 10->69 19 oRNbc.exe 14 2 10->19         started        21 oRNbc.exe 12->21         started        signatures5 process6 dnsIp7 29 vitalsoap.com.pk 192.154.254.69, 49691, 49692, 49697 DC74-ASUS United States 14->29 31 mail.vitalsoap.com.pk 14->31 37 2 other IPs or domains 14->37 25 C:\Users\user\AppData\Roaming\...\oRNbc.exe, PE32 14->25 dropped 27 C:\Users\user\...\oRNbc.exe:Zone.Identifier, ASCII 14->27 dropped 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->43 45 Tries to steal Mail credentials (via file / registry access) 14->45 47 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->47 33 mail.vitalsoap.com.pk 19->33 39 2 other IPs or domains 19->39 35 mail.vitalsoap.com.pk 21->35 41 2 other IPs or domains 21->41 49 Tries to harvest and steal browser information (history, passwords, etc) 21->49 51 Installs a global keyboard hook 21->51 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/485b45513f839ff3c972cbd2434273388b87c070c8c6125a8462aeabe2fb96d5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-07-28 16:12:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jbnukuj7qop7hslszpjegqtthcfypqdqzddbewuemkxkxyx3s3kq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1e5492854f8e9e427a594ac5938e7a798e084f7bc960a62fdfa076e3f929de57
AgentTesla
3c3bfc4353b8c082ab7c4202df58d8008cd322258c4c5505d387cf3a128b78ee
AgentTesla
4a6391439592ce3581a5d2c8f6195cc7e582d69222cf0e23d6bb0e8962abd1c2
AgentTesla
7deb65a2ec42de8489a8b8283a8927b3ec8301e4297e5daadc58f172b9c289db
AgentTesla
8cb05af5d5848832ac7006071a842f3566196a891cd232ff3602b550803e73c5
AgentTesla
ba519e6832804d25ebdd7d18ec62bdf3e68f18f8fbd9b90f9701509938cb28d1
AgentTesla
ba7f9aa187f2834a0e730911db8e70b035a93c5bfd1d98306a1b8841ee63d9a8
AgentTesla
d56f7dbd535d973bc8b14f22c58ab9c658e0bbe3f3139e7c16c619dba98ec664
AgentTesla
ee0e2a4caec3cfd987893177d930a6ba9d61a27b9e4a04d6169d2fe0b797c170
AgentTesla
+ 5'402 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
collection persistence spyware stealer
Link:
https://tria.ge/reports/230731-h6nfsadc55/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
7c743d979549f931d7101d1a14c14841ff47c848a3f30e31882d0d958bf5f941
MD5 hash:
508ba12479b3d78edb93f63b40ab3b7f
SHA1 hash:
d72b842c46546e4e494c9338b530e305dae1d5d2
Link:
https://www.unpac.me/results/1b861d5b-1875-4237-a4c8-f40943a2fed9/
SH256 hash:
683c25098c03dd626a8070c0430f056c16386142db9d64c02a68fc0c490d0e2a
MD5 hash:
4c33c9daf2748874aa8c100f5b429a32
SHA1 hash:
b0bbbe69ea625dd296e8c519cf9636b366c536ce
Link:
https://www.unpac.me/results/1b861d5b-1875-4237-a4c8-f40943a2fed9/
SH256 hash:
ee9d226ae4c757a231b3f7972da2e8cc1cfb194fcb246d2944b8d2d3d9dfd83e
MD5 hash:
fb6c7d5d3a829ca47a21d78d48ea53b7
SHA1 hash:
514ff85e763e0ae03d551840c078f68203b17e06
Detections:
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/1b861d5b-1875-4237-a4c8-f40943a2fed9/
SH256 hash:
0b21c2aa6d9b8f807ff7171103c0d3311a852223f66c22c0223d2044dfcd8e60
MD5 hash:
d80ad864ea9b71a6f27a19209a17b26a
SHA1 hash:
33b7929963dba2dd3800a6e5ab8c530cb9cbd3ba
Link:
https://www.unpac.me/results/1b861d5b-1875-4237-a4c8-f40943a2fed9/
SH256 hash:
485b45513f839ff3c972cbd2434273388b87c070c8c6125a8462aeabe2fb96d5
MD5 hash:
24064073cb8d91a8ae77aee762ef1c1d
SHA1 hash:
360dde23757e8eacd3ce7beebdaf9323bae070ad
Link:
https://www.unpac.me/results/1b861d5b-1875-4237-a4c8-f40943a2fed9/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/485b45513f83/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 485b45513f839ff3c972cbd2434273388b87c070c8c6125a8462aeabe2fb96d5

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2693417/
Cape
Cape
https://www.capesandbox.com/analysis/439342/

Comments


Avatar
zbet commented on 2023-07-31 07:20:23 UTC

url : hxxp://79.110.49.136/_errorpages/blinkzx.exe