MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62413ad16a42665b9396e1cce548b6e212c5cf21d3d2d8ae8c02ba83bd69fa0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 62413ad16a42665b9396e1cce548b6e212c5cf21d3d2d8ae8c02ba83bd69fa0e
SHA3-384 hash: 32259577cf0e07bbde6d2ee993fbd6759616a2d206a72a04007213ddf3f952c42f05840810e0f6726a5752c6c1c0a553
SHA1 hash: 85ddbc5f79df4b2b060297d26561e7b72ee32c38
MD5 hash: a0792aae7b2522318d8d5fae237810f2
humanhash: texas-speaker-foxtrot-nebraska
File name:a0792aae7b2522318d8d5fae237810f2.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:678'400 bytes
First seen:2023-04-06 15:14:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:zKEGQzhp94k/r8HCqTkYZzzv4YGiDpflRg0UsCkcu6GSJ6Ci9w79Ndbxb804aemf:zKEGQtp93r8iqoozzb3UsCkcu3SoCsIJ
Threatray 1'944 similar samples on MalwareBazaar
TLSH T145E49D521A624BD6D6B90D6007787A884678AF42D710633E7C83BD3F8CFBB5B50953E2
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
270
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a0792aae7b2522318d8d5fae237810f2.exe
Verdict:
Malicious activity
Analysis date:
2023-04-06 15:17:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/db41a054-ccd9-4378-8edb-38cccc367212

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/380674/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook packed
Link:
https://www.filescan.io/uploads/642ee1f8c9a9e6a6d828465d/reports/d0e21795-5e1e-4de1-b7b4-fcab81025f4d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/62413ad16a42665b9396e1cce548b6e212c5cf21d3d2d8ae8c02ba83bd69fa0e
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/beee6b1e-4ef7-434e-b8c8-e11d629088cd
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1209791
Signature
.NET source code contains potential unpacker
Installs a global keyboard hook
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/62413ad16a42665b9396e1cce548b6e212c5cf21d3d2d8ae8c02ba83bd69fa0e/
Threat name:
ByteCode-MSIL.Trojan.RemLoader
Create hunting rule
Status:
Malicious
First seen:
2023-04-06 12:57:57 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
16 of 35 (45.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mjatvulkijtfxe4w4hgoksfw4ijmltzb2pjnrlumak5ihplj7iha._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1f84c574a2f7836be22289a50c618d60dca14790609889eff1e25f8cdf49f468
AgentTesla
366a6d6e0aed96880c3589d33f5ee493ddfcc1f93cbe61e02b43867fa74f73b7
AgentTesla
71bb21d0c0cd50a53a292e523455a0b270fa255f63cd132395fded0d91c447d4
AgentTesla
74b2a6d74db90390fddf0241a3bb844633c1368584ff8c5fe37416331334cbf6
AgentTesla
8ef2718c254555dcf4f3717e512b73e066d99ae1df7663bb38ab13a17b0a594d
AgentTesla
96c4ff43a964578b8d6e88df75059042c2c7fb55ffafb416c797c36324fd459d
AgentTesla
b4a5e199a29723b27c6aced8f28c7b39f29738bfb2ea3ada079e38c4aad366f4
AgentTesla
e2e68b7e99d8253a02362747671cd1a55293166b771043a7bdb689f56331abc9
AgentTesla
+ 1'934 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230406-smwm6ade99/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
1853fff1f5947ed3d33b93fd0a618d7b16ecd190ce89b9278cabcb2ccc98d60e
MD5 hash:
2071f7474ac73ca96058c9e45a70b9e2
SHA1 hash:
9ee35a382eaee0b5b9e5ad9c365ddbde5c761ea4
Link:
https://www.unpac.me/results/0439f34f-b8d0-47a0-9df6-45268dc7f203/
SH256 hash:
b554eaf97a215800fa11882427b217ad26997da2bad1e4d249b7d4ac4b94c3e0
MD5 hash:
2882eaa07a9b3d876420c92a86557479
SHA1 hash:
94fb18c86af58eb6942af7494a437c71f57796a9
Link:
https://www.unpac.me/results/0439f34f-b8d0-47a0-9df6-45268dc7f203/
SH256 hash:
3c507afadbb1c31a9ebdd24baac5739d47576159e01c5e84f973c951885100aa
MD5 hash:
e79bf0e7e9d52d398e0b23b352394c68
SHA1 hash:
682325763a0ec77e0fd475ea3a4021b4651eceac
Link:
https://www.unpac.me/results/0439f34f-b8d0-47a0-9df6-45268dc7f203/
SH256 hash:
8d0d73bca286a4b6d0130bbe65e63935f26d9acbf58a4724b41263d95b13bc88
MD5 hash:
7e65182e80ec0e491a5bb33e8db80ae3
SHA1 hash:
0d921adb99090e2f825615102758e8acc9fd50e4
Link:
https://www.unpac.me/results/0439f34f-b8d0-47a0-9df6-45268dc7f203/
Parent samples :
cce03ee9cac9ccbacb587c0fb5426aa0435a9e1278d0d5472ab0ae06139687ed
1884b7ff2246263409d8e8d53d03371c80affdc9bc588455d0b86e2a77c5cbf1
ac4f95e274427abe5af52a9af50ffc74db27a0c87969d1097dc35d75d36d77d7
9652929fc702b8e9aa0d69b6902bb69b845d3445b174d2b1ec25923de63cad76
98d735989cc1423bdd21526c42deaa86db9982f5c7e6c09d37adb881afa9c8f8
d21806c0151bf7c8df900c319a6eb1ce315ee00298860fdbe1aef252fb3ba160
SH256 hash:
ae09f69ae1f8064255a4cc374070d4a882a3abba00639ee1c206eed3f2982e98
MD5 hash:
c75f4fc5f57dcfda371b334c7baa78b0
SHA1 hash:
608bea0ef153549552916b3089ac2b7334b07464
Link:
https://www.unpac.me/results/0439f34f-b8d0-47a0-9df6-45268dc7f203/
SH256 hash:
62413ad16a42665b9396e1cce548b6e212c5cf21d3d2d8ae8c02ba83bd69fa0e
MD5 hash:
a0792aae7b2522318d8d5fae237810f2
SHA1 hash:
85ddbc5f79df4b2b060297d26561e7b72ee32c38
Link:
https://www.unpac.me/results/0439f34f-b8d0-47a0-9df6-45268dc7f203/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/62413ad16a42/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/62413ad16a42665b9396e1cce548b6e212c5cf21d3d2d8ae8c02ba83bd69fa0e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 62413ad16a42665b9396e1cce548b6e212c5cf21d3d2d8ae8c02ba83bd69fa0e

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/380674/
  
URLhaus
https://urlhaus.abuse.ch/url/2299038/
  
Delivery method
Distributed via web download

Comments