MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b931eba421ceaec90cb942759c2ed28919f648a91f8f28985f3dd6d8df4044c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b931eba421ceaec90cb942759c2ed28919f648a91f8f28985f3dd6d8df4044c
SHA3-384 hash: 9ec5352b63241f831d51daef831185abee2d1c2214596d04b1b32bac85389ecb08a62fcad1825b1de21899cc04f5941c
SHA1 hash: 5ee09ff188d43a90f7f36e5f2aa2651c046d2e11
MD5 hash: 83084e558cf8accca3a9b7fbd0474ab6
humanhash: alpha-queen-west-winter
File name:TnG6X9AzUnLE5in.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:821'248 bytes
First seen:2023-06-15 18:59:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:ZPxV52iNoOe42KMu/N3mWhQmwmJCMpUbMbCTWZAqXMo/3gIv4SbWZ1R1/gMrCdf0:xxv1mOV/NOauDqXMoPhvLArrgn0
Threatray 5'463 similar samples on MalwareBazaar
TLSH T1F705012D32AB9B0EC57A7BFC5D249630C3E9AD463073E31A0ED334EA9C7575448916A3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter threatcat_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
330
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
TnG6X9AzUnLE5in.exe
Verdict:
Malicious activity
Analysis date:
2023-06-15 19:00:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/701fdcbe-d75c-4da6-b568-3734ab330e37

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XorStringsNET
Create hunting rule
Link:
https://www.capesandbox.com/analysis/399294/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
clipbanker comodo darkkomet packed
Link:
https://www.filescan.io/uploads/648b5fb3153b44fd385a0984/reports/221c517d-3be8-41c3-a4ac-0ea2276306dd/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/6b931eba421ceaec90cb942759c2ed28919f648a91f8f28985f3dd6d8df4044c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6549f2ca-45e8-450b-8294-3b367cb891b0
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1255541
Signature
.NET source code contains potential unpacker
Found malware configuration
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6b931eba421ceaec90cb942759c2ed28919f648a91f8f28985f3dd6d8df4044c/
Threat name:
ByteCode-MSIL.Trojan.Spynoon
Create hunting rule
Status:
Malicious
First seen:
2023-06-12 09:17:30 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
24 of 37 (64.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nojr5oscdtvozeglsqtvtqxnfciz6zeksh4pfcmf6pow3dpuarga._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1b9a2dc6ca050349b9b0f180706742b64e734eb334c02afd87d7108eff1d4ec8
AgentTesla
74d26f4b119393b4528ff36ae1ed9ddf2fd9b6e36f3dbd9c7456ad692687905c
AgentTesla
7f911bcd5a1ca8927a6519e6ddad2119994783767579bae6dec65c937254f611
AgentTesla
84c7973871a6a639c40534f9e3fd7135bd35cd1b0eee937cc849af90c903c4c2
AgentTesla
8e861cbf43bd4068930cb5ef3821cab163fad49d42b77c66b70fff8fa038db48
AgentTesla
aa23406d036894ae210e0531e6014c1377bdb409619cde6143e69d0a8dc7b85b
AgentTesla
aceea30675a0a44b4efad41f7321aa4c5ca66baa1ddb805f4cc12df821bd1775
AgentTesla
b10acd083d1cf3feeddb56662116b26f583d5505f8c7f6a746c091a54895237f
AgentTesla
bb992023216a9723d9157cacbe3f2dec846902eacce0122734d6111c85ee6309
AgentTesla
ff927067632cbc9312282420e5ed0e75505e871970b76c169cd57f0ca52c3d84
AgentTesla
+ 5'453 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230615-xnmtvsah38/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
e33bc8d638269afb0487de4deecef387ad8efa90969696aa9e9525801a06613d
MD5 hash:
24ee758e7955f595f6877f0e2e6e7538
SHA1 hash:
cfe0b2bd06189c8c5116b3a0b790b83c7d76df0c
Link:
https://www.unpac.me/results/3aae05a5-7f5f-4446-8522-b9550900155f/
SH256 hash:
16a6751bded745cae51923406018f309ec63e773be390bfef48f768089480aa3
MD5 hash:
db4eeef86bc93fe51718a7b0b12d6380
SHA1 hash:
c0de4203a937b4aff9f61a15013fd88415424a43
Link:
https://www.unpac.me/results/3aae05a5-7f5f-4446-8522-b9550900155f/
SH256 hash:
ecc88936f723129015277a1b56aeb3fff31127feb4a21d390f6a572f036924b8
MD5 hash:
ff8d4bd0ddd29629defd6723910c71a9
SHA1 hash:
a88f0292b6c3b38f9c74a65f4bb2b3fa5c961df3
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/3aae05a5-7f5f-4446-8522-b9550900155f/
Parent samples :
6b931eba421ceaec90cb942759c2ed28919f648a91f8f28985f3dd6d8df4044c
bc1415731a9741b45e3cf26d00860b2e3ebff43550c7926d4dbf9ef06ad0058d
SH256 hash:
f8dbc6077f6b01c6eec334061d687ff1b291a2aa5513cf1e0b5bde4a8dbc5588
MD5 hash:
15aab611795bcbf2758052944013be1a
SHA1 hash:
772a1002b111e117cf3b1e9f0cabda4894777399
Link:
https://www.unpac.me/results/3aae05a5-7f5f-4446-8522-b9550900155f/
SH256 hash:
90abc1235306796e82f284392509f1cd6c9150b8fa2b93b5cd976537462c7b53
MD5 hash:
363cc1ac1fa18f653a353d6e8cbc18ae
SHA1 hash:
63670df5c3909c16060eae0e74b491f1985ea37f
Link:
https://www.unpac.me/results/3aae05a5-7f5f-4446-8522-b9550900155f/
SH256 hash:
6b931eba421ceaec90cb942759c2ed28919f648a91f8f28985f3dd6d8df4044c
MD5 hash:
83084e558cf8accca3a9b7fbd0474ab6
SHA1 hash:
5ee09ff188d43a90f7f36e5f2aa2651c046d2e11
Link:
https://www.unpac.me/results/3aae05a5-7f5f-4446-8522-b9550900155f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6b931eba421ceaec90cb942759c2ed28919f648a91f8f28985f3dd6d8df4044c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 6b931eba421ceaec90cb942759c2ed28919f648a91f8f28985f3dd6d8df4044c

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/399294/

Comments