MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 513b504d6939f1a106cf21f1f4029ab30c5f701fbcf63881b1a5df7466ed2eb1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 513b504d6939f1a106cf21f1f4029ab30c5f701fbcf63881b1a5df7466ed2eb1
SHA3-384 hash: 69ffcc4c3e2a8080085a6130b2cb7f9a8c62c6782000c9c33c1523402e6ae8d3936064dd8530188a7c5d7cf777385997
SHA1 hash: efe3f9713eb8f8569f653e2549434e2309e44ea7
MD5 hash: af2ff31385848a9916f9f4c4a01fc0a9
humanhash: lemon-single-south-papa
File name:Q&A session 1 RFQ-INDOM-2023-013 final.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:617'984 bytes
First seen:2023-07-05 12:28:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:PeyooR/t43XlNvAmYpTi1QDzS5xtbb9vOpgFA9:roQiXxMBzS5xtbIpmY
Threatray 4'577 similar samples on MalwareBazaar
TLSH T118D46C3C1CBC7226C170F6B68FADC460F160956B3E618E3765C39999471EA0269CBE3D
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter malwarelabnet
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
280
Origin country :
CA CA
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
Q&A session 1 RFQ-INDOM-2023-013 final.exe
Verdict:
Malicious activity
Analysis date:
2023-07-05 12:30:26 UTC
Tags:
agenttesla rat
Link:
https://app.any.run/tasks/2b06a99e-5d3a-430c-92f8-4d67c1f4823d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/407599/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1995.5261.1475.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/64a5620f9d2b91874b44366a/reports/34d170d8-40a2-4ad1-b8fa-0dd8879d861f/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/513b504d6939f1a106cf21f1f4029ab30c5f701fbcf63881b1a5df7466ed2eb1
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/19ad4a6a-9369-4f80-900f-ba7ca1bbafe1
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1267218
Signature
.NET source code contains very large strings
Found malware configuration
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/513b504d6939f1a106cf21f1f4029ab30c5f701fbcf63881b1a5df7466ed2eb1/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-07-05 02:10:52 UTC
File Type:
PE (.Net Exe)
Extracted files:
26
AV detection:
21 of 38 (55.26%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ke5vatljhhy2cbwpehy7iau2wmgf64a7xt3dranruxpxizxnf2yq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1214fcf60b88a08f596efec828f1ea8744b30aa6ff141c8a98f45dc6b2a51658
AgentTesla
326d089faa6a93f0cb06311fd787593691b405807a399263e602964fc58de21e
AgentTesla
47764a3fd4c9b5502c0f927992cfd4a3c7e16b70228b613c08ec60733ce8f60c
AgentTesla
84ebd97fd1765dc6341db835a8dc4cff8edefd8f263f87e7b1c89b9d60167447
AgentTesla
96fdf5c2a638bb7b2390fc8764534d26027446115f781706aa67d1e83234dcd3
AgentTesla
988de5533ea7c98cdc0974eeb98cc650bdc4f991df9c8f0f85c5a7d4e7611b45
AgentTesla
9c4bed3e367c58faa476e1f02c6f3270daba50527eee5a20d4f25a4610cd56e2
AgentTesla
ea9c43836863f74a0ea38ed27e6a24e3e4fbc5846b49b502af5505348d683eb5
AgentTesla
+ 4'567 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230705-pnwsrsdg5y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
SH256 hash:
bb545e85c2632a4cff8c8684e8731d51b84e61a15fd210e6964adab1c6c1e988
MD5 hash:
c177077484e7fcfa456fff7def0e5301
SHA1 hash:
82364dbc074f6ffde4a0f5276d77596bd3cea332
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
SH256 hash:
988de5533ea7c98cdc0974eeb98cc650bdc4f991df9c8f0f85c5a7d4e7611b45
MD5 hash:
173dca1136f18febdf8370b171eab365
SHA1 hash:
74528a60287cad71165c6c3fe2fabdcab9fa0f10
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
Parent samples :
988de5533ea7c98cdc0974eeb98cc650bdc4f991df9c8f0f85c5a7d4e7611b45
513b504d6939f1a106cf21f1f4029ab30c5f701fbcf63881b1a5df7466ed2eb1
9f8dd7a2f5e56970c9e6aa9af1c62b9d1d2ee03ca5dc33f9d6d376edd3bc0cdd
eb617190b27e7449ed078297a96bf5b8b11e02e0f3bf1fa2bc947cac60e8590c
SH256 hash:
973512f00ba81a790d2351f286c79dfea92692c9f7cd724e22ab11ff282f8130
MD5 hash:
3794c5f7b240e4184d6ea90c5bdd9ec6
SHA1 hash:
26b9c4a753779b4994fe38c16dfe70b07efd3e0d
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
SH256 hash:
bb545e85c2632a4cff8c8684e8731d51b84e61a15fd210e6964adab1c6c1e988
MD5 hash:
c177077484e7fcfa456fff7def0e5301
SHA1 hash:
82364dbc074f6ffde4a0f5276d77596bd3cea332
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
SH256 hash:
988de5533ea7c98cdc0974eeb98cc650bdc4f991df9c8f0f85c5a7d4e7611b45
MD5 hash:
173dca1136f18febdf8370b171eab365
SHA1 hash:
74528a60287cad71165c6c3fe2fabdcab9fa0f10
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
Parent samples :
988de5533ea7c98cdc0974eeb98cc650bdc4f991df9c8f0f85c5a7d4e7611b45
513b504d6939f1a106cf21f1f4029ab30c5f701fbcf63881b1a5df7466ed2eb1
9f8dd7a2f5e56970c9e6aa9af1c62b9d1d2ee03ca5dc33f9d6d376edd3bc0cdd
eb617190b27e7449ed078297a96bf5b8b11e02e0f3bf1fa2bc947cac60e8590c
SH256 hash:
973512f00ba81a790d2351f286c79dfea92692c9f7cd724e22ab11ff282f8130
MD5 hash:
3794c5f7b240e4184d6ea90c5bdd9ec6
SHA1 hash:
26b9c4a753779b4994fe38c16dfe70b07efd3e0d
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
SH256 hash:
bb545e85c2632a4cff8c8684e8731d51b84e61a15fd210e6964adab1c6c1e988
MD5 hash:
c177077484e7fcfa456fff7def0e5301
SHA1 hash:
82364dbc074f6ffde4a0f5276d77596bd3cea332
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
SH256 hash:
bb545e85c2632a4cff8c8684e8731d51b84e61a15fd210e6964adab1c6c1e988
MD5 hash:
c177077484e7fcfa456fff7def0e5301
SHA1 hash:
82364dbc074f6ffde4a0f5276d77596bd3cea332
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
SH256 hash:
988de5533ea7c98cdc0974eeb98cc650bdc4f991df9c8f0f85c5a7d4e7611b45
MD5 hash:
173dca1136f18febdf8370b171eab365
SHA1 hash:
74528a60287cad71165c6c3fe2fabdcab9fa0f10
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
Parent samples :
988de5533ea7c98cdc0974eeb98cc650bdc4f991df9c8f0f85c5a7d4e7611b45
513b504d6939f1a106cf21f1f4029ab30c5f701fbcf63881b1a5df7466ed2eb1
9f8dd7a2f5e56970c9e6aa9af1c62b9d1d2ee03ca5dc33f9d6d376edd3bc0cdd
eb617190b27e7449ed078297a96bf5b8b11e02e0f3bf1fa2bc947cac60e8590c
SH256 hash:
988de5533ea7c98cdc0974eeb98cc650bdc4f991df9c8f0f85c5a7d4e7611b45
MD5 hash:
173dca1136f18febdf8370b171eab365
SHA1 hash:
74528a60287cad71165c6c3fe2fabdcab9fa0f10
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
Parent samples :
988de5533ea7c98cdc0974eeb98cc650bdc4f991df9c8f0f85c5a7d4e7611b45
513b504d6939f1a106cf21f1f4029ab30c5f701fbcf63881b1a5df7466ed2eb1
9f8dd7a2f5e56970c9e6aa9af1c62b9d1d2ee03ca5dc33f9d6d376edd3bc0cdd
eb617190b27e7449ed078297a96bf5b8b11e02e0f3bf1fa2bc947cac60e8590c
SH256 hash:
973512f00ba81a790d2351f286c79dfea92692c9f7cd724e22ab11ff282f8130
MD5 hash:
3794c5f7b240e4184d6ea90c5bdd9ec6
SHA1 hash:
26b9c4a753779b4994fe38c16dfe70b07efd3e0d
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
SH256 hash:
973512f00ba81a790d2351f286c79dfea92692c9f7cd724e22ab11ff282f8130
MD5 hash:
3794c5f7b240e4184d6ea90c5bdd9ec6
SHA1 hash:
26b9c4a753779b4994fe38c16dfe70b07efd3e0d
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
SH256 hash:
513b504d6939f1a106cf21f1f4029ab30c5f701fbcf63881b1a5df7466ed2eb1
MD5 hash:
af2ff31385848a9916f9f4c4a01fc0a9
SHA1 hash:
efe3f9713eb8f8569f653e2549434e2309e44ea7
Link:
https://www.unpac.me/results/eedca7d7-24ed-41a4-926d-0edb9b399e70/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/513b504d6939/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/513b504d6939f1a106cf21f1f4029ab30c5f701fbcf63881b1a5df7466ed2eb1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/407599/

Comments