MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4db98b32811e0daa01908ed57c890899315de8bf5a9baf120532423a80f80f44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 14

Intelligence 14 IOCs YARA 23 File information Comments

SHA256 hash:	4db98b32811e0daa01908ed57c890899315de8bf5a9baf120532423a80f80f44
SHA3-384 hash:	bb76fb045ab6f0ce663bc3ad3241f160578ffa8a1d288360d89fe411a8f10831dd6917195f42aaf4613d744180d258b0
SHA1 hash:	18955a4209d901f996817086a67c0868527b9a40
MD5 hash:	686eaab5df53839499f52cca9e63cdb8
humanhash:	lake-pennsylvania-five-london
File name:	4db98b32811e0daa01908ed57c890899315de8bf5a9baf120532423a80f80f44
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	2'007'968 bytes
First seen:	2025-02-07 14:10:21 UTC
Last seen:	2025-02-07 14:40:26 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep	24576:z/HW1+EtlEuGLR+EWfh/1vIHVli533wMni2DjrXBmFFRo:LYtlP2Q9eHVA5D1vXBmFFR
Threatray	48 similar samples on MalwareBazaar
TLSH	T16F957A0123A8CF16E4AF2770E47241F84AB7BD02EE3597DF1684BDAA39B27419D50367
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
File icon (PE):
dhash icon	0f519373d9cc750b (107 x AgentTesla, 20 x AveMariaRAT, 5 x Formbook)
Reporter	adrian__luca
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

226

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

4db98b32811e0daa01908ed57c890899315de8bf5a9baf120532423a80f80f44

Verdict:

Malicious activity

Analysis date:

2025-02-07 12:59:02 UTC

Tags:

evasion ftp stealer agenttesla exfiltration

Link:

https://app.any.run/tasks/0a22cf84-fc6b-4aaf-b7a4-74913af1bb09

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.3210.4423.24286.UNOFFICIAL

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Unauthorized injection to a recently created process

Restart of the analyzed sample

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for recently created files

Reading critical registry keys

Creating a window

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Stealing user critical data

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/4db98b32811e0daa01908ed57c890899315de8bf5a9baf120532423a80f80f44

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/9792b717-c5b1-43ec-b6d2-61eac72a8b0f

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1609694

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

Connects to many ports of the same IP (likely port scanning)

Contains functionality to log keystrokes (.Net Source)

Drops executable to a common third party application directory

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Suricata IDS alerts for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Costura Assembly Loader

Behaviour

Behavior Graph:

Download SVG

Score:

95%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/4db98b32811e0daa01908ed57c890899315de8bf5a9baf120532423a80f80f44

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4db98b32811e0daa01908ed57c890899315de8bf5a9baf120532423a80f80f44/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2025-01-21 08:43:43 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

17 of 38 (44.74%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jw4ywmubdyg2uamqr3kxzciiteyv32f7lkn26eqfgjbdvahyb5ca._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

4db98b32811e0daa01908ed57c890899315de8bf5a9baf120532423a80f80f44

AgentTesla

691bd2b76ebd32787a26a353c915e1438bb317d1c90bda5eeae0c9057cf33f44

AgentTesla

8262eff81e1dfcbfc3faf587466a7690b55ec6ea5f2f89711a971b22eaa9bf43

AgentTesla

b10d57be4b44bbcb4efe602901bb2817b1ea921051c255f23a6f1134729fdab2

AgentTesla

e8f8d1388590647fec6cb2861455ca70e0d11f08ab9669cc6f45f0938587fc99

AgentTesla

e99a8a8773f059814fdcd835c6c7a8ae5284c4943987a374a96e14a8b799335d

AgentTesla

error

AgentTesla

f8e2ae197b0e7009fdcb3d71e6cfa572d6f06ee7b7a0bca889d55f8d78c1cf26

AgentTesla

+ 38 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/250207-rg1jgstmdy/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

Looks up external IP address via web service

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Agenttesla family

Suspicious use of NtCreateUserProcessOtherParentProcess

Verdict:

Suspicious

Tags:

external_ip_lookup

YARA:

n/a

Link:

https://app.threat.zone/submission/219540da-3ad9-4842-9773-e9eea7027388

Unpacked files

SH256 hash:

4db98b32811e0daa01908ed57c890899315de8bf5a9baf120532423a80f80f44

MD5 hash:

686eaab5df53839499f52cca9e63cdb8

SHA1 hash:

18955a4209d901f996817086a67c0868527b9a40

Link:

https://www.unpac.me/results/87e07fa2-038c-4be5-a778-c73654b33a77/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4db98b32811e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV2 Create hunting rule
Author:	ditekshen
Description:	AgenetTesla Type 2 Keylogger payload

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	AgentTeslaV5 Create hunting rule
Author:	ClaudioWayne
Description:	AgentTeslaV5 infostealer payload

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	MALWARE_Win_AgentTeslaV2 Create hunting rule
Author:	ditekSHen
Description:	AgenetTesla Type 2 Keylogger payload

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Windows_Generic_Threat_808f680e Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample