MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 60b0830b3d046627ac7d33aed8c3c8aa871d0f235c831ef9acd14f938faa0a0f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 15
| SHA256 hash: | 60b0830b3d046627ac7d33aed8c3c8aa871d0f235c831ef9acd14f938faa0a0f |
|---|---|
| SHA3-384 hash: | 343296801cf35507a9da80fdda5db359fb0df048737d64fa867c897d43108f5c08d63300433351c598ef372b04384d76 |
| SHA1 hash: | 39e45a531cadb253f9a51fe64a080922faf8bee9 |
| MD5 hash: | ca36190ddc4907be2dece16457b45893 |
| humanhash: | cardinal-double-missouri-maine |
| File name: | e-dekont.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 912'384 bytes |
| First seen: | 2023-11-22 06:55:48 UTC |
| Last seen: | 2023-11-22 08:16:48 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 12288:B8obJ1SGYdrG1gm8mSGiyUm7jj7jOb7nPTDm4UqTtevk6x:6OSGMqgf5+3ju7nP/mHr |
| Threatray | 2'580 similar samples on MalwareBazaar |
| TLSH | T1DE156DD1F15088DAED6B06F2BD2A653024E3BE9D54A4810C599DBB1B76F3342209FE1F |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | eeacac8cb6e2ba86 (561 x SnakeKeylogger, 142 x AgentTesla, 40 x Formbook) |
| Reporter |  lowmal3 |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
3
# of downloads :
323
Origin country :
DEVendor Threat Intelligence
Detection:
AgentTesla
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Gathering data
Verdict:
Malicious
Labled as:
Ransom.Loki.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Detection:
agenttesla
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-11-22 05:54:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
33
AV detection:
22 of 37 (59.46%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla_v4
Similar samples:
+ 2'570 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://discord.com/api/webhooks/1176618094270087188/ska8K-IVLXPC4XPgrIiupFjKjBIz3HGdgungFafUV_84d3Tfn341sZlAGngmmh9aBBpS
Unpacked files
SH256 hash:
186bc47f84bd549cd52598955cdb159efc8f11c6c04ab3d72b42f2e85aeb7669
MD5 hash:
46f31ce406879d3fa817588414d40997
SHA1 hash:
86724872ac35ec0a7f2ba704c9ccb5b6120384f5
SH256 hash:
18248f007e0342921d14b044001395c8447b73534cfee7a4c89a90e681b51a6b
MD5 hash:
adad3a3e7925f43b9f797f289d25f890
SHA1 hash:
4e7d436dc161026da67ef02b78acf02d7d9b38dc
SH256 hash:
7bdc5ba2651e953cb969b9adb35148eaf311a3c76abaeed6284969410d8c26f4
MD5 hash:
c9ff72d40fd6e587dc653ba0afd83f10
SHA1 hash:
448733f5790f0133ff7db2ba931ff54843c09ecd
Detections:
win_agent_tesla_g2
Agenttesla_type2
INDICATOR_EXE_Packed_GEN01
INDICATOR_SUSPICIOUS_Binary_References_Browsers
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
INDICATOR_SUSPICIOUS_EXE_DiscordURL
SH256 hash:
0a32ecdd3b3bb545b57497780365a2669a03c3106a6951ff70245360528e3d46
MD5 hash:
9af1b6b897d6de7618e45f11dc7a0d60
SHA1 hash:
2d1579de029d90c7e8869d14b0cddda814fc2abe
SH256 hash:
60b0830b3d046627ac7d33aed8c3c8aa871d0f235c831ef9acd14f938faa0a0f
MD5 hash:
ca36190ddc4907be2dece16457b45893
SHA1 hash:
39e45a531cadb253f9a51fe64a080922faf8bee9
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AgentTesla_DIFF_Common_Strings_01 |
|---|---|
| Author: | schmidtsz |
| Description: | Identify partial Agent Tesla strings |
| Rule name: | BitcoinAddress |
|---|---|
| Author: | Didier Stevens (@DidierStevens) |
| Description: | Contains a valid Bitcoin address |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.