MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5da64e1746667364ade20610d6e1211e7a582d15e53ad69a339675ca626df391. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5da64e1746667364ade20610d6e1211e7a582d15e53ad69a339675ca626df391
SHA3-384 hash: 9bb617b0ce7db55abc8d8e3adfbbd9b6ceb649e82187c6368bd15e5e2bc2d437aa8bc476a91ee2cf7983a3ae545f1f36
SHA1 hash: 23448866f2a0aba15f677b2b42d188c7d9a92ff2
MD5 hash: 8be6dd10cb1f6f78ffdd487017d84c4d
humanhash: muppet-fruit-michigan-lemon
File name:brucezx.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:876'544 bytes
First seen:2022-11-02 13:41:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:FFFkeEEFYRyfI5an/upMYQLQZILIBc1Khtjj+eNX0KsNTSWbdi/Mx:xz/Q4/upeQZDB6MtVK/TSWbQ/Mx
Threatray 22'946 similar samples on MalwareBazaar
TLSH T1FA15D01F0ADA061AC6AA3AB845E4E7FBA7DA9C41F417C31717C59D8FB847370D6103A8
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
224
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
brucezx.exe
Verdict:
Malicious activity
Analysis date:
2022-11-02 13:56:32 UTC
Tags:
agenttesla
Link:
https://app.any.run/tasks/5309f2af-ab83-4e22-8403-413c9760a436

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/327186/
Detection(s):
SecuriteInfo.com.Trojan.Olock.1.24716.12173.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/636273ac736e9d884f0dde26/reports/be3902c3-c89e-459e-aa3b-30c754fe0248/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4c826476-31ff-4f48-b504-68998d3166dc
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1103316
Signature
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5da64e1746667364ade20610d6e1211e7a582d15e53ad69a339675ca626df391/
Threat name:
ByteCode-MSIL.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2022-11-02 09:10:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lwte4f2gmzzwjlpcayinnyjbdz5fqliv4u5nngrtsz24uytn6oiq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
194b21139e3a9a343c63617ad33ee48abdfa1566a4302a04b65df43888395400
AgentTesla
1969ef2785557b7ef71514305c4ac60f913089b3db51e49b896d26a9bc7bc3f8
AgentTesla
57723ebe18b3371ec8c844fa7a0bc1039b420d2cf56759a2ad3cd087b459989f
AgentTesla
64b497c548522493d43bceed2cc41630f90f044eee97c973aadf9a230d4ec500
AgentTesla
cd53ca02d3f26bf3e6431e6d86c9379f9f77f7e67cddba40ae9a16f85569334b
AgentTesla
da3907286f538586573df79364298076e3e1605daadc7de588e57fe1544604df
AgentTesla
fc770cf10f538ed1ee6db0d1bcb6d8119199acdc947730a56b10bf46e0dcb5dd
AgentTesla
+ 22'936 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/221102-qzn3qsbgfm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/83b3960e-1dc6-4125-8d21-87b130f995dd
Unpacked files
SH256 hash:
722d53bf3b84229809edebf3221e0c8f35ab9738282129e8ca947db45adf6e8b
MD5 hash:
7f8a9b996fa50a272fc46ec823a28f9e
SHA1 hash:
c70faa1cca6d57fa5aff924c0ad25f7a532995f5
Link:
https://www.unpac.me/results/869be848-ea2b-4cae-82aa-8d0b14ffc30a/
SH256 hash:
6af0957088165b1387a2ee24ba0509b0d784c1d6e8631dedd2a00beca48a9c6d
MD5 hash:
1e28da4b9d63720f114e4fa336f59a9a
SHA1 hash:
7c2a0db2f1f76b83db82319a46d08c679b52eae8
Link:
https://www.unpac.me/results/869be848-ea2b-4cae-82aa-8d0b14ffc30a/
SH256 hash:
cfc16a2dbb933b1b85807d48966e9301b9fc34f4c44e7357713ca88b54bf4ab4
MD5 hash:
aabd0bdc81026ade6c57383f21d5c227
SHA1 hash:
4b26936bb8c03be6d7963184215a5ab594ecb765
Link:
https://www.unpac.me/results/869be848-ea2b-4cae-82aa-8d0b14ffc30a/
SH256 hash:
8354a7ad0499febdd288542828ad0355dcb7054c0c518266208e571c5122b0c6
MD5 hash:
6bfc7ce9ec7891d9d8494454332099b5
SHA1 hash:
34fc8cebba035e2cc6d27d636f9655949080bf8e
Link:
https://www.unpac.me/results/869be848-ea2b-4cae-82aa-8d0b14ffc30a/
SH256 hash:
d54a85e568b371a6bc91d20d31d802a962ff3e16cbd408e486b3878f35f0a883
MD5 hash:
1bf98cb1b49f7c8223c1d042ec8406b4
SHA1 hash:
0e0226838ee8ef88350822598b8d81bbb45034e8
Link:
https://www.unpac.me/results/869be848-ea2b-4cae-82aa-8d0b14ffc30a/
SH256 hash:
5da64e1746667364ade20610d6e1211e7a582d15e53ad69a339675ca626df391
MD5 hash:
8be6dd10cb1f6f78ffdd487017d84c4d
SHA1 hash:
23448866f2a0aba15f677b2b42d188c7d9a92ff2
Link:
https://www.unpac.me/results/869be848-ea2b-4cae-82aa-8d0b14ffc30a/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5da64e174666/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5da64e1746667364ade20610d6e1211e7a582d15e53ad69a339675ca626df391

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/2395312/
Cape
Cape
https://www.capesandbox.com/analysis/327186/

Comments