MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5458e3bb6f919b8dc46d243475fd72f0bb1f30ff2604cabc675bb1c707dbed97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5458e3bb6f919b8dc46d243475fd72f0bb1f30ff2604cabc675bb1c707dbed97
SHA3-384 hash: 601bc4eb71554d029abb7d6ba06d44274811e692087a1a2378ce261411d68f37402bcdac40cf61e01288b63811d2f906
SHA1 hash: 891112b49a2c6c296da01ed25ebe9a880a12f44b
MD5 hash: 4e8108d273525e669543496f20babb7e
humanhash: romeo-princess-enemy-vermont
File name:4e8108d273525e669543496f20babb7e.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:886'784 bytes
First seen:2023-03-09 08:46:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 24576:Za/5u61gLw0TTcBfPpZ7vvqnRtbNuG0GOc5:KZ0MBZNvqRtFt95
Threatray 1'396 similar samples on MalwareBazaar
TLSH T17A15CF9573B19563FC8F41BA192BE29C2D7171437365E23B5B773AE0D6019BFB288202
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 00f0f4f4eca43600 (5 x Loki, 5 x SnakeKeylogger, 5 x AgentTesla)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
223
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4e8108d273525e669543496f20babb7e.exe
Verdict:
Malicious activity
Analysis date:
2023-03-09 08:52:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/70f377ec-5be5-4cb4-9b36-c7cb0c686f2e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/372925/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64099d0858ebe55355909bbf/reports/ed7c0175-c2b4-4249-8747-22833cc1cca7/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/5458e3bb6f919b8dc46d243475fd72f0bb1f30ff2604cabc675bb1c707dbed97
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0d146a58-33ad-4814-a4ec-233042d63d0e
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1190157
Signature
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5458e3bb6f919b8dc46d243475fd72f0bb1f30ff2604cabc675bb1c707dbed97/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2023-03-08 09:29:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
13 of 38 (34.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=krmoho3psgny3rdneq2hl7ls6c5r6mh7eycmvpdhloy4ob635wlq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1b500a500c912eed51044243c54249ccd8a1f0912cae4f72764108c6bc07e7e8
AgentTesla
3047d199e9540948a25c577cc9181b77d26708c2539c660706a8fd12fec2db1b
AgentTesla
433e7f14b1114b2b401e99fcfcc04cb7bcf5e7fcf402821cea3663124dac5644
AgentTesla
4d265e6df24188d863cd6dee6439b264c2006dd9a203a6e47d72fdb398081015
AgentTesla
5b62fd08b3a979449bc21a217e7057e710e5a66ab1f4159a935db45629e24156
AgentTesla
6dbd277a53e2c621a778a18ed9fc38ed556afc145683481aeb55301d1a574961
AgentTesla
85609c31587f7752298afe029c049ab5ead5997bfbc6cc31151bf5e90ed41072
AgentTesla
bc282c69e6f9c69b93651c0d399318577b6f9494c0b851eadb4a5b44bfef1262
AgentTesla
bd0c9e976c855ac799940806d40aaf41a214241bd303a9d3f35fe410544eb447
AgentTesla
cac42576ce1d941b30261fea52e04e229a88db712de63e283320dc63c3e13e20
AgentTesla
+ 1'386 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230309-kpw3psbe62/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
36dc655578f28ce552de0e886a2235c105ee62b2951cfb9ab2e7fcbaff41a093
MD5 hash:
2cca516420a1e9f8575b56e58318c6fa
SHA1 hash:
9bcc4eb262be2460825eafa32ad3db53f3577920
Link:
https://www.unpac.me/results/f84af5d5-a50c-485c-a05b-e64ee276beab/
SH256 hash:
dd49948e0b3393a8b53084075ec2f2a8c36813d1ba1ca538697eb62ec4b4deae
MD5 hash:
538dab51e58b7dd3809664982f4d0746
SHA1 hash:
4e7f9615f1d96b087c453a72217662f867e0520d
Link:
https://www.unpac.me/results/f84af5d5-a50c-485c-a05b-e64ee276beab/
SH256 hash:
39c3f4ed1ad5f6ee1d405d9f00823603d5109f023e70aa5e543376962eb5255e
MD5 hash:
f721f760102b13b3f4a3e8159bfb8bad
SHA1 hash:
2c5f44760a167648bac42f8fc499f6cf636e457f
Link:
https://www.unpac.me/results/f84af5d5-a50c-485c-a05b-e64ee276beab/
SH256 hash:
8f0c7e3047346b8d6477ff6d4639fd6157602c7ebc840f3432b99263f1cb415c
MD5 hash:
e5b073b30db1b058298f5df032164e4d
SHA1 hash:
15d3ada4e7ac01b766615b9b66785e7e2ae9b0ca
Link:
https://www.unpac.me/results/f84af5d5-a50c-485c-a05b-e64ee276beab/
SH256 hash:
cb85d77cb556485e6eeefe2a1ce6d97ad85c7a44ed766246b8b72f45418ce16b
MD5 hash:
419114395634a1b160754fbe2f316f50
SHA1 hash:
109b84c5a8b8fea96c90df66cf25a664fdf92d41
Link:
https://www.unpac.me/results/f84af5d5-a50c-485c-a05b-e64ee276beab/
SH256 hash:
5458e3bb6f919b8dc46d243475fd72f0bb1f30ff2604cabc675bb1c707dbed97
MD5 hash:
4e8108d273525e669543496f20babb7e
SHA1 hash:
891112b49a2c6c296da01ed25ebe9a880a12f44b
Link:
https://www.unpac.me/results/f84af5d5-a50c-485c-a05b-e64ee276beab/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5458e3bb6f91/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5458e3bb6f919b8dc46d243475fd72f0bb1f30ff2604cabc675bb1c707dbed97

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 5458e3bb6f919b8dc46d243475fd72f0bb1f30ff2604cabc675bb1c707dbed97

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2322915/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/372925/

Comments