MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d466d0ee8fc3db2bce2be746b7fb4bd14cfc9930f95fa7cb89473bed4bd5c5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d466d0ee8fc3db2bce2be746b7fb4bd14cfc9930f95fa7cb89473bed4bd5c5a
SHA3-384 hash: 2574caec48bb3928a4156ab5242faa35b2fd75964553c0fd8330409e5f5dd67120f522f03e8c1eec74cbae4776198181
SHA1 hash: 7603e0d0fe2850c0df657b5cb2a4fd1bcbd0c30c
MD5 hash: e205ec10c26a441e790ee82ff39c7728
humanhash: whiskey-michigan-nitrogen-missouri
File name:File#BOL.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:896'000 bytes
First seen:2021-11-17 07:04:48 UTC
Last seen:2021-11-17 09:12:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:QS8drhCcfZ/2Yp4CdkaKkVFC7AKI1FZ8kx60XJS2zG9+aw9cNq0p2W:Zk/2Yp4Cd9VFllZjZqN
Threatray 12'779 similar samples on MalwareBazaar
TLSH T13115015537B51F43C4FE83F8562A824007F6766962A7E71E2CC371DB3D62B924B82A07
File icon (PE):PE icon
dhash icon c8c4e2f934dc2e16 (10 x Loki, 6 x Formbook, 6 x AgentTesla)
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
File#BOL.exe
Verdict:
Suspicious activity
Analysis date:
2021-11-17 07:07:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/29baba47-f78e-42ce-aeb3-f39dbe4560a3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/206713/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.19817.24187.899.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6194a9a14912a8c920a119ad/reports/5ea83139-f4b7-4dc9-bc25-82db4e785bba/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3d4363c7-2a02-4e79-a438-9c770eb89ff3
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/890975
Signature
.NET source code contains potential unpacker
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Modifies the hosts file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 523448 Sample: File#BOL.exe Startdate: 17/11/2021 Architecture: WINDOWS Score: 100 45 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->45 47 Found malware configuration 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 4 other signatures 2->51 6 File#BOL.exe 3 2->6         started        10 kprUEGC.exe 3 2->10         started        12 kprUEGC.exe 2 2->12         started        process3 file4 27 C:\Users\user\AppData\...\File#BOL.exe.log, ASCII 6->27 dropped 53 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->53 55 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->55 57 Injects a PE file into a foreign processes 6->57 14 File#BOL.exe 2 5 6->14         started        19 File#BOL.exe 6->19         started        21 File#BOL.exe 6->21         started        23 File#BOL.exe 6->23         started        25 kprUEGC.exe 2 10->25         started        signatures5 process6 dnsIp7 35 mail.aquanova.es 51.83.52.225, 49685, 587 OVHFR France 14->35 29 C:\Users\user\AppData\Roaming\...\kprUEGC.exe, PE32 14->29 dropped 31 C:\Windows\System32\drivers\etc\hosts, ASCII 14->31 dropped 33 C:\Users\user\...\kprUEGC.exe:Zone.Identifier, ASCII 14->33 dropped 37 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->37 39 Tries to steal Mail credentials (via file / registry access) 14->39 41 Tries to harvest and steal ftp login credentials 14->41 43 3 other signatures 14->43 file8 signatures9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4d466d0ee8fc3db2bce2be746b7fb4bd14cfc9930f95fa7cb89473bed4bd5c5a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-17 00:48:36 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jvdg2dxi7q63fphcxz2gw75uxukm7smtb6k7u7fysrz35vf5lrna._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1dafe7dc7107f57fd8eb9cc96bcb9f4a83fd8232797e1f82dc525fad2a842911
AgentTesla
33ce082a006f04e5ffff0f486747cb08ae7f44dee113fdaeb4be781de66c1fb2
AgentTesla
80524e38d83418165e3b94d048ce7aacce3f5ac2f51968c3aea368784704b1f2
AgentTesla
9b21ddd12ab442996f40e9eaa498cd1a3c17c9f157ca3f173ab742f94bbca33b
AgentTesla
cc2cfe4218cb861b14fdc741dd0c7118c09099345048f9239baec1e62691bcee
AgentTesla
fdfccd2b06ff7ace13bd64a1d1035f62dc5c81e303f0e96733680713b2b4294f
AgentTesla
ffbad515588df376e86216b15b2a092570d1dc91116e787de8648060ef06895c
AgentTesla
+ 12'769 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/211117-hwhsjshfb8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
b8dd7624f37552c00001588cb69cdd6b1a89d38f421e36093d46a620f6ba0dbf
MD5 hash:
c5d8f2596d36bbdc9f8f1b067f43175c
SHA1 hash:
e0c38080aed73e7cea14f6a10e99244693a06ae8
Link:
https://www.unpac.me/results/370dcb86-b920-45bd-ae4d-710ca675a72e/
SH256 hash:
e1d4166d327202fd98eda5a478dc95f809b0cbeec47216447fbe52fd798ce817
MD5 hash:
a8286d03ee43e1ace44a5edf2e8f2639
SHA1 hash:
d4117dc6c8c3cc1b8717434ee66daf2eada717d6
Link:
https://www.unpac.me/results/370dcb86-b920-45bd-ae4d-710ca675a72e/
SH256 hash:
86fe170cc6dd3a576807c1192a06ead68bf210f9ccd14f1a81d4f44c2dbcc25f
MD5 hash:
bf5c170790a9378101dbc312303925e3
SHA1 hash:
bddaf21c02ba5cec7c4dfd1b1f289e23714a8ba8
Link:
https://www.unpac.me/results/370dcb86-b920-45bd-ae4d-710ca675a72e/
SH256 hash:
105c4aa94779201994b8032b10d35b74e2fff476da40d4c853df4c2320f5a504
MD5 hash:
fdc98c32588e21c5db45c08ef666990d
SHA1 hash:
9094d2178d4b3cd0cdba61532667288c04208365
Link:
https://www.unpac.me/results/370dcb86-b920-45bd-ae4d-710ca675a72e/
SH256 hash:
4d466d0ee8fc3db2bce2be746b7fb4bd14cfc9930f95fa7cb89473bed4bd5c5a
MD5 hash:
e205ec10c26a441e790ee82ff39c7728
SHA1 hash:
7603e0d0fe2850c0df657b5cb2a4fd1bcbd0c30c
Link:
https://www.unpac.me/results/370dcb86-b920-45bd-ae4d-710ca675a72e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4d466d0ee8fc3db2bce2be746b7fb4bd14cfc9930f95fa7cb89473bed4bd5c5a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 4d466d0ee8fc3db2bce2be746b7fb4bd14cfc9930f95fa7cb89473bed4bd5c5a

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/206713/

Comments