MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49ad7ac8d6e28582f693f893e0e664d2bf01f105cdc68e251452ead03774d70a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49ad7ac8d6e28582f693f893e0e664d2bf01f105cdc68e251452ead03774d70a
SHA3-384 hash: b5af14c452bff3d169809e6931e143218dd7288cdaeddbbc013ac6c96441a79aac970a33db33bc6929e5ee1d6efb7775
SHA1 hash: 306b4b7eeddc84422488bf13c6b28c1116aa30bf
MD5 hash: 823705096ac9b4f30ed41b4a3fae197e
humanhash: ink-sad-vegan-twelve
File name:open-order#456789.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:941'056 bytes
First seen:2023-06-16 14:31:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:IzG7EcvG73htU7/2eQ1x9DWJVrMaVM3I+JzpwIqzZUTSKgo+iiy7wPzivap0Q:l7EgG1tCuei+5MPXJVHSUeKKu
TLSH T15115CF9D355079DFC827FD768F942C74BAE469AB570BD243941318E89A0CB9B8F102E3
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter threatcat_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
340
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
open-order#456789.exe
Verdict:
Malicious activity
Analysis date:
2023-06-16 14:33:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8f21ae91-dfd9-46fc-97d2-440cccbb6b68

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XorStringsNET
Create hunting rule
Link:
https://www.capesandbox.com/analysis/399510/
Detection(s):
Sanesecurity.Rogue.0hr.20230613-2034.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
formbook packed
Link:
https://www.filescan.io/uploads/648c7262153b44fd385a1ccd/reports/927a90d6-c104-45b2-83de-601beec15e72/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/49ad7ac8d6e28582f693f893e0e664d2bf01f105cdc68e251452ead03774d70a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c4ce7ebf-4bbb-4ff5-af15-1728ec785887
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1256127
Signature
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/49ad7ac8d6e28582f693f893e0e664d2bf01f105cdc68e251452ead03774d70a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-06-13 11:02:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jgwxvsgw4kcyf5ut7cj6bzte2k7qd4ifzxdi4jiuklvnan3u24fa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230616-rv9z3sfb5w/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
AgentTesla
Unpacked files
SH256 hash:
d23d723fc6796c442bce06202179587dfba4becb4aaf613c5cd5de413f52f1f5
MD5 hash:
afd68f8a18bb3be211ed0c13bfbeaff4
SHA1 hash:
74d4204f1fdbfb2d19006fcf0fd8c7e5d989443e
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/c336bcc0-7f32-4291-9056-20bc0206948b/
Parent samples :
78b2c60dab71f835b8163d190c0befd4daf3ef2d574f2dd717a52feb82d497b2
d63f3bfd1d9356906b66380f6a1b6153ba5d8e950b3b24bddaf47b01294186a8
a62d9307bbcf6c6a1da2a346c9c53a1354d6678d960d2641469ddf2e8fe3c758
e037d9d7acd5564e330b8398de2958a117feb43520454f1f8838983ae829428c
60a107b83a792df4cafbe67547cf3663ee3e2277572f8778bb78bd226d9188d8
e3ca74ba964904f1c186ddc5b0586512d8ea65f0cedbbda4e1577dd264a3afff
3c1afe298565b77c5c91c36fc8758fc967e90d849f20f9d4daa68c082a8a1206
1b3662e68c3970c3ad2c9cff4b034a88823e67c7da54842519ac8dfefd87a883
cf6d236b07b02bcded4e19c6bb1ce31df4993c2961fb8544a9337969e44eff9c
abef18ea3dd420650a3c4ffbae70c8a3409788f67986c0bb08955a85b6b3a290
7f19e4ea2342241c1abf3ed44b08ff44caaa4b5b389d89736e972cdfb576e400
fd4226a0d754290aa133ea1a8606846290cac4ec317a8622072d38fca80e8bbe
49ad7ac8d6e28582f693f893e0e664d2bf01f105cdc68e251452ead03774d70a
4575f52d6dc0ce07e65e72a0a40007a6eb4c3676d87306dddf5e64d4efc6cc7d
d2b24cbb8fe2a9485ea49df5ffd98cd0073cd47de55e0da79e91618afc4528fe
42d3d31c5ff9fe13b77ac0716ae91a9cec28dc173d820c51f2efaf85e5b0b3de
9ab4351395cfc81d8afabb133e442989b54696cad65e22de72d58398505762bd
54959cafb25e974b115becc4c5e8154beed352e95f3fdcd5adf3d2752cc6376e
4bc4516b5db503b67107df186362ebf8d3029fe3a98c9ad777fdc2568f427113
SH256 hash:
13e9be0aba1cef3943954d2a204472356721075f8ecbfe565a476aec8346fdc6
MD5 hash:
4ce78b41df3f0bb4dff20793bcc9f78d
SHA1 hash:
4de22b09a356224b9916836ba2ee181d369d5f4f
Link:
https://www.unpac.me/results/c336bcc0-7f32-4291-9056-20bc0206948b/
SH256 hash:
d896e9cbed9020c3d6d6378cdf66468fdfcb44e4bdf8539ede8b5c7d2441347a
MD5 hash:
396e182948a7b12e9205e2f713fc57ed
SHA1 hash:
42b4686fb78443cb09b5779c0113486504ad62d7
Link:
https://www.unpac.me/results/c336bcc0-7f32-4291-9056-20bc0206948b/
SH256 hash:
250cc9a51d6ade446ae8ded6cde3712db43f05a34c0f43c790972632975bb032
MD5 hash:
284762ab4ff04c0ebaac25a2d3d25046
SHA1 hash:
3edff336617ea0c4aa53991af29575feda4ca564
Link:
https://www.unpac.me/results/c336bcc0-7f32-4291-9056-20bc0206948b/
SH256 hash:
e6703ee1233f19a2f9b09ea6cd3a8ffe4ac6c205c2cd1704d2a3376cb4c63a1a
MD5 hash:
ff4386030d7c5166ca82a92116ce3ae5
SHA1 hash:
3bd05036c346eecae2a9fc16e9c59ee01cfc0602
Link:
https://www.unpac.me/results/c336bcc0-7f32-4291-9056-20bc0206948b/
SH256 hash:
49ad7ac8d6e28582f693f893e0e664d2bf01f105cdc68e251452ead03774d70a
MD5 hash:
823705096ac9b4f30ed41b4a3fae197e
SHA1 hash:
306b4b7eeddc84422488bf13c6b28c1116aa30bf
Link:
https://www.unpac.me/results/c336bcc0-7f32-4291-9056-20bc0206948b/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/49ad7ac8d6e2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/49ad7ac8d6e28582f693f893e0e664d2bf01f105cdc68e251452ead03774d70a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 49ad7ac8d6e28582f693f893e0e664d2bf01f105cdc68e251452ead03774d70a

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/399510/

Comments