MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 588b4100c87eab6cb8bb73ffdfb5a2644132961b353e0465190daf43a8e3766c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 588b4100c87eab6cb8bb73ffdfb5a2644132961b353e0465190daf43a8e3766c
SHA3-384 hash: f29afcce4e6736b9429ca281d7ef9584a7aadffd264b4c2fc512fc3aa746353c5e530eb87dd487da2ec960d734377173
SHA1 hash: 9fcabf5de732d6fc7e1ab3f36f27fcf9f8ea4b70
MD5 hash: 16daec16a0d03e1a61c9a5fb78c557e0
humanhash: twenty-cat-mountain-oven
File name:SecuriteInfo.com.Win32.MalwareX-gen.17006.32651
Download: download sample
Signature AgentTesla
Create hunting rule
File size:695'296 bytes
First seen:2023-12-21 09:16:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:Y2/wh8tvQ8FJexPkn3x7f/Bj+jNe1PzQtfcej7fR49UurO33XpySq:zDPaPKBj+RgbqEcDR49Uu0pyH
TLSH T1A8E4239833A85153C8FE2BBB1D3272C847B2B52BAD22F54C9CC054FC25D7B45962266B
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 64f4d4c49c9c9cd4 (4 x AgentTesla, 1 x NanoCore)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
332
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/468769/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Win32.MalwareX-gen.17006.32651.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
DNS request
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/658402546b1c246046ff6ef8/reports/2a165ee5-132e-4517-a98d-8f0892dc0d54/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/588b4100c87eab6cb8bb73ffdfb5a2644132961b353e0465190daf43a8e3766c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dff0369d-22d9-46ff-a191-bf6fe009bc94
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1365481
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/588b4100c87eab6cb8bb73ffdfb5a2644132961b353e0465190daf43a8e3766c
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/588b4100c87eab6cb8bb73ffdfb5a2644132961b353e0465190daf43a8e3766c/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-12-21 08:26:19 UTC
AV detection:
11 of 37 (29.73%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lcfucagip2vwzof3op757nncmratffq3gu7aizizbwxuhkhdozwa._file
Verdict:
malicious
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/231221-k8f6lagdar/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
2aae29a8dafc0018516106b98438de41f482a7e66f035a83109278cc8e41d841
MD5 hash:
63cdd9df3d9a53d800a5a88d2cd0ac44
SHA1 hash:
c8851171abac5bda5fcfde850ff9040a56ddcb9b
Link:
https://www.unpac.me/results/95abcc98-8c85-4bf9-8fc8-e450b88238e7/
SH256 hash:
21641a9069d48b81a249af61b628ce768926be28201f0fbddefaaf2343d835ef
MD5 hash:
dbe8c17b24c2b241dd62bb876b0bfc0a
SHA1 hash:
be0c0aefe203b8904b00b26dd876d53d9dee1640
Detections:
AgentTesla
Create hunting rule
win_agent_tesla_g2
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/95abcc98-8c85-4bf9-8fc8-e450b88238e7/
Parent samples :
b900561fb670c0e97d474ae9d54a8505010dd9b182823b1bca74e7242bc72102
9f6599786b1b7f64b75d3b570209b0cd0286011c89591cc71321191fb637afca
c63f7bf40f81e3654685888a1f6731e1b87dc49edf0177de8503bba2389eee4a
46d22a4b883bc7074c98641941e335b0ed43bbf67017d3f461f8dace83da6b55
590070cb43f95f574fd1216b8165c2c3298fb91a9781980c68011eb7e0d810ec
fa5195110ab813fd692abb50ffa507844863ff858d22492133632551aedf1121
839e99379a8b401715d4d172895e7d901a66bfe643bd9be96a56f6d3aadc7773
990b71c0e3c625ca07987bb97900f37d10a260df8585438c48e628541509632a
bee896925d62192aff4e13abda9cc0cff1cd063778b2dadb45035edd5d274c8a
9ee7811e79cf1f1f76aadb17175227bf172b21ed84a54a53ef98a1f4695f75ba
588b4100c87eab6cb8bb73ffdfb5a2644132961b353e0465190daf43a8e3766c
SH256 hash:
7637830cf6f098ecccf191260962e230257cdc077b5471b0afdbd46fda66f5fa
MD5 hash:
537e0db2dde6587ad2f5de8a8b9f127a
SHA1 hash:
7698b14797e57b226d8f3329653a049693227adc
Link:
https://www.unpac.me/results/95abcc98-8c85-4bf9-8fc8-e450b88238e7/
SH256 hash:
5e37ee9774fd7bda219d51e2e4784c125884f4a00b1db6353dbbc4bd9ecdf121
MD5 hash:
df86ef97f6bb97c06c9cb1bc32706b5e
SHA1 hash:
35db852de84ce293e4bb16124423cd1549909d8c
Link:
https://www.unpac.me/results/95abcc98-8c85-4bf9-8fc8-e450b88238e7/
SH256 hash:
588b4100c87eab6cb8bb73ffdfb5a2644132961b353e0465190daf43a8e3766c
MD5 hash:
16daec16a0d03e1a61c9a5fb78c557e0
SHA1 hash:
9fcabf5de732d6fc7e1ab3f36f27fcf9f8ea4b70
Link:
https://www.unpac.me/results/95abcc98-8c85-4bf9-8fc8-e450b88238e7/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/588b4100c87e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/588b4100c87eab6cb8bb73ffdfb5a2644132961b353e0465190daf43a8e3766c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/468769/

Comments