MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a5f5cfe6237d8ae6191f1f21ada6671ce1968e6438730051edf22c994c9c6d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 15

Intelligence 15 IOCs YARA 2 File information Comments

SHA256 hash:	4a5f5cfe6237d8ae6191f1f21ada6671ce1968e6438730051edf22c994c9c6d8
SHA3-384 hash:	2f1ef24b56d5b01218f7ea7c1afab26a097f351c94991a04e5efa6f8c470473886ae95f00d054bf041ad2fbe53527a75
SHA1 hash:	29e892f40d2e971fae717b107ca20a83e33b547b
MD5 hash:	a0d6f0661883d042576dc181c119b657
humanhash:	mountain-ceiling-oscar-jersey
File name:	mercy.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	657'920 bytes
First seen:	2023-07-13 14:03:14 UTC
Last seen:	2023-07-13 14:34:45 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:+uFFMGQIut7D7P1rDWi/IFvg6chCsRDss7uryZ8Uik:+uFFMz7XPRDWOIpuHesSlUi
Threatray	4'847 similar samples on MalwareBazaar
TLSH	T1A0E44B0B3DD02A57E42E423E007C6A6CEBEED11E566FD924342DD2A3B2F664C194D74B
TrID	63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

308

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

mercy.exe

Verdict:

Malicious activity

Analysis date:

2023-07-13 14:05:44 UTC

Tags:

agenttesla stealer

Link:

https://app.any.run/tasks/1a867001-45fc-442c-855e-498742f8b2ed

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/417556/

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.29179.14838.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Launching a process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lolbin packed replace tracker

Link:

https://www.filescan.io/uploads/64b00454a15fc7eb4fd20542/reports/3f496ab7-2e70-42e2-9a32-6055d56ac8a5/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/4a5f5cfe6237d8ae6191f1f21ada6671ce1968e6438730051edf22c994c9c6d8

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/42fe9859-0fe4-48ae-aac7-4947429c0b93

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1272543

Signature

Antivirus detection for URL or domain

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/4a5f5cfe6237d8ae6191f1f21ada6671ce1968e6438730051edf22c994c9c6d8/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2023-07-13 03:27:45 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 38 (52.63%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jjpvz7tcg7mk4ymr6hzbvwtgohhbs2hgiodtabi634rmtfgjy3ma._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

8b2a9586bcf26045ba196d4714d8c628feb5d8eed4604ff82c6e3625b67a9437

AgentTesla

a9adeec302ab071989a321a13b0c9b1f12e4c0fd69f3dab0a99e46d165a40cd3

AgentTesla

ac7241d053bf5ff507bdca963f36e762237aa8489970f7d04792bb8170e172ac

AgentTesla

b8affa2c64dd1a3661fd9ea46581ea09b733871562c2d080f2c81923e7275961

AgentTesla

b8df60f662a857421bd7725a0265ed231b227aa688b7b0e583d00b4eb1130ea4

AgentTesla

bb89170bee6cc45c068be0dbc7cd40078abb554065094f6bafd91575c7b2023c

AgentTesla

c6e20af2fcd85eb6d5091e3fae90a2cd37ebc6ff0be026d1cf097df5b4c7bc3b

AgentTesla

ccc2705cc016a910af89b39b5beeca2885eedd714cca5ab153b416c201d0ea96

AgentTesla

d106446fe25932f01efe8164e5dfa001b5c8a05a8d42a3bfd90c306b5814ea54

AgentTesla

+ 4'837 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230713-rc9atshh3x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AgentTesla

Unpacked files

SH256 hash:

50b224aa5cbf278ebbd6735f82a453307fac9b9e1ac07f0d908761ced1480ada

MD5 hash:

95a555c0a90b9f7c8dccf5e413bda6fb

SHA1 hash:

e7cbc1cd65d9b80a89656eae39c53d4dfc92fd8a

Link:

https://www.unpac.me/results/622c75ed-09c0-4a43-95c8-dee21000e6fe/

SH256 hash:

9b10f99a51843bf3661d6659482d6a956458f744f31ef2e7c28b631af924db08

MD5 hash:

18a1605204cec2dac8202fe810064492

SHA1 hash:

4e13e899b737d47177b0cb216c095fb750911d09

Link:

https://www.unpac.me/results/622c75ed-09c0-4a43-95c8-dee21000e6fe/

SH256 hash:

84ee2d025fab349279b7ea3323e69a616d118f723b1daa71699364bf6ab2daca

MD5 hash:

d4a9f2af0d4f638b5acee5d7399ed548

SHA1 hash:

18e731b5bcf3711660cefe7fc289dd5017099cfd

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/622c75ed-09c0-4a43-95c8-dee21000e6fe/

Parent samples :

ac7241d053bf5ff507bdca963f36e762237aa8489970f7d04792bb8170e172ac
c6e20af2fcd85eb6d5091e3fae90a2cd37ebc6ff0be026d1cf097df5b4c7bc3b
b8df60f662a857421bd7725a0265ed231b227aa688b7b0e583d00b4eb1130ea4
4a5f5cfe6237d8ae6191f1f21ada6671ce1968e6438730051edf22c994c9c6d8
f63529cbbb9347615150ed2c567ae06bf9cf3c343b2c4c001ffae7b3ca5551ca
e9cb510832b3b160bf13dfc363895802d0febe7b21d290ebfbb9292843996b02
0cef466011ca31b7a4df0482271b4e270de1b1194d0f16bcc98b391c04abd017
d79d684befececf09462e561697c0cfcea6cfdd518a92b56a404a89bf8ed3041

SH256 hash:

4a5f5cfe6237d8ae6191f1f21ada6671ce1968e6438730051edf22c994c9c6d8

MD5 hash:

a0d6f0661883d042576dc181c119b657

SHA1 hash:

29e892f40d2e971fae717b107ca20a83e33b547b

Link:

https://www.unpac.me/results/622c75ed-09c0-4a43-95c8-dee21000e6fe/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.