MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b4cd3b97c5e9949ad66d175d6dab6c6105fe4fb4ee9497aa8b6ea374034832f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b4cd3b97c5e9949ad66d175d6dab6c6105fe4fb4ee9497aa8b6ea374034832f
SHA3-384 hash: 5c5943cd7b4fe6489a0be3037207c5564128489b43119540a4f3ce67ead35012712e4776096492b65f6749223bd3d1ce
SHA1 hash: b9a3682c3c4dc8ff485238553aad1aa6342bd2d7
MD5 hash: 4d492c7d7df12d0a967a40f72724177b
humanhash: salami-beer-shade-bulldog
File name:4d492c7d7df12d0a967a40f72724177b.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:987'648 bytes
First seen:2023-02-22 11:10:22 UTC
Last seen:2023-02-22 12:54:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:/zXkyLr2ayjh1eNIWl9S7fMJtEHccs8z5xNV0S+l6cYi8Pt+pAWBqRSJkdv+fBxW:rky9IISwJ+HlNVTRVPo8RsaCxW17xR
Threatray 868 similar samples on MalwareBazaar
TLSH T1B425BE9973B46073F4CB01FE5C38278D2E2075477119E26E9B77BB92A270AFB7298111
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4d492c7d7df12d0a967a40f72724177b.exe
Verdict:
Malicious activity
Analysis date:
2023-02-22 11:39:16 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/89b1a4d7-40c6-4ca0-9d6a-f61544a25f4a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/368991/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
75%
Tags:
packed
Link:
https://www.filescan.io/uploads/63f5f84742bf85850e3f39b0/reports/c6fd6fe2-2c7e-4f7b-b47e-c115701d4677/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/6b4cd3b97c5e9949ad66d175d6dab6c6105fe4fb4ee9497aa8b6ea374034832f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/686af6f4-b932-44f7-b02e-24b121f44522
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1180514
Signature
Contains functionality to register a low level keyboard hook
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6b4cd3b97c5e9949ad66d175d6dab6c6105fe4fb4ee9497aa8b6ea374034832f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-02-21 12:02:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
20 of 25 (80.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nngnhol4l2mutllg2f25nwvwyyif7zh3j3uus6viw3vdoqbuqmxq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
102fd6ec47edeeb5e28e561c51b9e175a8ecd1de62e8afb73167a16b171a2694
AgentTesla
20c94daf0506d27a6bd3de27e378fc900dd44a32328a41912d60fd26677d426d
AgentTesla
4033d9c9ef268cf2bdf04bb0e1c549e5461ba27026797edf70121468abbd1203
AgentTesla
41857a1bfb1cda7337d39a4c6bcec253fb44532179f9cb12e919608f227e3dcb
AgentTesla
5ab1b0331432b81a28182c2d38fd0c1ed9c5eec7f7aa847bbd2b75fa1a88ce77
AgentTesla
8089619c8dba1d0d3a52b272d619fd6658adc82fd4f44df48582b0d6505f673d
AgentTesla
9d8720d03350b0737e0a315bdf24d79a1344d87c1027a7f01b9971a3e000d01c
AgentTesla
cab8030aedb4d80563698d091a018b5a43d817b31dbe937d5f27f944722cd9ac
AgentTesla
f144fef878393aa69f18f5cf812ee9a62b0224ccb21936321c8f98d65c98d2f6
AgentTesla
fecccddacfc2789e4d1d60fc600b8451643bf26f8877307e119e00774167d581
AgentTesla
+ 858 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230222-m989wacg9y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://discord.com/api/webhooks/1075887334303748266/u8Nrxb0SNd0-_hLZmle74zb3s1_g7nazO4AFHWQ-xeAnmWLI8dX4hffXPdxsWEWxdEMM
Unpacked files
SH256 hash:
f11ca8a4ea5b7a7c2b982020fec273ab6246b75ad4c9e45fbd475eb0a1350c17
MD5 hash:
2a0a9f880a5fc4e16971fc0752b0854c
SHA1 hash:
84952dbf095679f3d5da366c6ef99f13136bb4c5
Link:
https://www.unpac.me/results/b15e230c-184b-406a-8aa5-1470d756cdac/
SH256 hash:
1a98a79f9dc984227cf5828bb96da372323b3c0b81f422e5ef45396d70f892df
MD5 hash:
b678b074c7bff54840eb4929ff1273aa
SHA1 hash:
776d1a921ba1fb1a2739930ca83442edaf90160f
Link:
https://www.unpac.me/results/b15e230c-184b-406a-8aa5-1470d756cdac/
SH256 hash:
93ab30cc7f935c4052f7defa0cdb05a75ba8614ea8e2f9558a86aca286b0b8a9
MD5 hash:
08da024859a5ac1eabad50917c53f6b7
SHA1 hash:
4717fa6fe73ef5da79f3124baf22efa08f24627f
Link:
https://www.unpac.me/results/b15e230c-184b-406a-8aa5-1470d756cdac/
SH256 hash:
e386840537170219177c2bb3404f4c7bd9da1a2d53cdf2ae1e857c3b19628a29
MD5 hash:
d170ab8c03b9c37d5be449454db131d2
SHA1 hash:
2031b6754a65d21b47dd11a34fee86f048d6048d
Link:
https://www.unpac.me/results/b15e230c-184b-406a-8aa5-1470d756cdac/
SH256 hash:
5fc75a657243327876ea9c0127c03f6c6939f2bc78d563575ec86e6b35047ace
MD5 hash:
40d1cb2f6d1d74dcafde3d9de964257a
SHA1 hash:
16c8f7ab7bc90d7d74c0965e3ec0a895f6377462
Link:
https://www.unpac.me/results/b15e230c-184b-406a-8aa5-1470d756cdac/
SH256 hash:
6b4cd3b97c5e9949ad66d175d6dab6c6105fe4fb4ee9497aa8b6ea374034832f
MD5 hash:
4d492c7d7df12d0a967a40f72724177b
SHA1 hash:
b9a3682c3c4dc8ff485238553aad1aa6342bd2d7
Link:
https://www.unpac.me/results/b15e230c-184b-406a-8aa5-1470d756cdac/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6b4cd3b97c5e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/6b4cd3b97c5e9949ad66d175d6dab6c6105fe4fb4ee9497aa8b6ea374034832f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 6b4cd3b97c5e9949ad66d175d6dab6c6105fe4fb4ee9497aa8b6ea374034832f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2322915/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/368991/

Comments