MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66f84a9485233c4126143d575a7d5d754721f963e71069a9456399c601af2ea8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 13

Intelligence 13 IOCs YARA 6 File information Comments

SHA256 hash:	66f84a9485233c4126143d575a7d5d754721f963e71069a9456399c601af2ea8
SHA3-384 hash:	1e917e8f97dcd9a789db59d979aa5d60db09fc938ac256ea411fecc9ba062a3cd9bf65f437a2d4797dc9045aba0c31be
SHA1 hash:	f9b52054c5020f0a6bc30ad369a0dbf06c9e3c16
MD5 hash:	d4bef4b07059e137cb445ad46607a039
humanhash:	nine-grey-snake-fruit
File name:	payment.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	616'448 bytes
First seen:	2023-04-03 06:57:05 UTC
Last seen:	2023-04-11 08:00:41 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'207 x SnakeKeylogger)
ssdeep	6144:nYlCTy6dfHrM0oyvqwVns5DnfuqpPhlpImWwhdGC7dAvTxxJn5I4h22cqnCBtVuv:nYlCTz/riyywVnmp5lBKC7Wjzg2cv0v
Threatray	1'805 similar samples on MalwareBazaar
TLSH	T100D45B3C0ABD67A2E179DF74DE708110F3F1A41BB721D96D2DEE008D0656E425AA372E
TrID	63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	cocaman
Tags:	AgentTesla exe payment

Intelligence

File Origin

# of uploads :

# of downloads :

236

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

payment.exe

Verdict:

Malicious activity

Analysis date:

2023-04-03 06:58:50 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/828e2db8-7947-4871-ae60-ceacc1c7d304

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/379524/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.66215651.5388.7286.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

DNS request

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

barys comodo lokibot packed

Link:

https://www.filescan.io/uploads/642a78fcd1b7f0d264f9e303/reports/5680a2c1-edd2-4661-bbce-aedd86691c8e/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/66f84a9485233c4126143d575a7d5d754721f963e71069a9456399c601af2ea8

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6432efb5-6f81-4abd-aa0b-8cc0a4b86a7a

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1206851

Signature

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/66f84a9485233c4126143d575a7d5d754721f963e71069a9456399c601af2ea8/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2023-04-02 16:09:46 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=m34evfefem6ecjquhvlvu7k5ovdsd6ld44igtkkfmom4manpf2ua._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

285c3ffd2b6cdd180ee0a3371f12f6a0ffb4a77ffc7a811f242749f68722242c

AgentTesla

30272b6380cb51f1ea1c8ba3c294fe504fb80179d4ac31cfa8eb641919137eca

AgentTesla

3d89d938245c8482b052606671e22041cae0ca7b12bb59214726b9dedb59f3a1

AgentTesla

5fdb6e2373c18ec9d19f822279bce3d0e84c731ae8c0410fdd613c59379e6ad9

AgentTesla

7ae177e05410a5674d60e619122fda381ca12b03bf136d6cb595a857c2cb51c3

AgentTesla

afee69594c18577546ad73e410935b8ae9a1038d0eed643333037a1cceb06724

AgentTesla

e8738a421e052a4b0824102fc4a1d6d530dfa5ab90a651e0aca6ff8730d2bc02

AgentTesla

ebfe3afe48dc47239d68700f74f01db8aef2b4c20f833178de5d55988d05a06a

AgentTesla

+ 1'795 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230403-hrhlzsdc69/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AgentTesla

Unpacked files

SH256 hash:

a7e17fcf14d55ff0ea177ea38105131dbb6cad90da1d22e24bbd2f33b9367a96

MD5 hash:

2bb5bbc146586605498fde034fbb861a

SHA1 hash:

9f3ebac3375bc1e6a7eb4276a977ac36d2fc3e09

Link:

https://www.unpac.me/results/0a79d7a7-8ef3-4bdf-87d9-f3d6997194d7/

Parent samples :

64e8bab99d5b2d4f60126625fc49cc873a8b3298a3ea7cb50197b0cbbc47d356
c4412128ec553fc7dd04832d11ccd68c8db5f08729ac401b78fba4c022127625
186fb618cd82863206b3da72960bb3c4dfa9ec3beafb10cc49fabd34f7cda05f
0693896df2ac61be0617616cae39f1d1c9b60c7953b9c45c93fa63d3764a1680
f8d54f533d483b1dd4bca77d1fdbbfe2165c2e63c06f9bb44c2b5c37d384b100
5522c9cb389b36d40cafd0cb1820934cdf53fe86827677cfe19b7b58d5affce6

SH256 hash:

ea8d4c91ec5bba5e1db6c17730d7ba5cdbb5ff3c1a777f70c90e91ce599d9b5d

MD5 hash:

27f5124bf8f451bca8d8a15c73c4f521

SHA1 hash:

5fd557e109b8fd1c3b362b64f0ba9f1600c07211

Link:

https://www.unpac.me/results/0a79d7a7-8ef3-4bdf-87d9-f3d6997194d7/

SH256 hash:

1f971a5f87caba7337d2d3691225b3baa4099f83abf24da209f21e951afdd5ae

MD5 hash:

89cb442978e4074cae717ec893b835e0

SHA1 hash:

0692a028c5d25f2501a93376d4bc46b227bd1b84

Link:

https://www.unpac.me/results/0a79d7a7-8ef3-4bdf-87d9-f3d6997194d7/

SH256 hash:

66f84a9485233c4126143d575a7d5d754721f963e71069a9456399c601af2ea8

MD5 hash:

d4bef4b07059e137cb445ad46607a039

SHA1 hash:

f9b52054c5020f0a6bc30ad369a0dbf06c9e3c16

Link:

https://www.unpac.me/results/0a79d7a7-8ef3-4bdf-87d9-f3d6997194d7/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MSIL_SUSP_OBFUSC_XorStringsNet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:	https://github.com/dr4k0nia/yara-rules

Rule name:	msil_susp_obf_xorstringsnet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Suspicious_Macro_Presence Create hunting rule
Author:	Mehmet Ali Kerimoglu (CYB3RMX)
Description:	This rule detects common malicious/suspicious implementations.