MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d7ca76f65a253a1587d1f5a94d7ff27d0babf11b830fd778efb96ebd8196442. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 17

Intelligence 17 IOCs YARA 17 File information Comments

SHA256 hash:	6d7ca76f65a253a1587d1f5a94d7ff27d0babf11b830fd778efb96ebd8196442
SHA3-384 hash:	60facfb65a39ce98229da6546972245127af02e5da1ad2b0a2f41e8465698e98170814e0f9d2bbaaaf105c1f23ecd1f9
SHA1 hash:	8f83d05ef4d201ee7b6dbc50eff66018a816ff73
MD5 hash:	9abefcb71f2f6808adc286ac83f5ef2e
humanhash:	vermont-xray-single-violet
File name:	ORDER FUZETEC PO2311-000031.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	392'192 bytes
First seen:	2023-12-04 08:51:21 UTC
Last seen:	2023-12-05 08:51:04 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	6144:EwTD974CbCFRov/04ak4+HG8GBZzUMTkI5yi8WY4Nf31h/m9vMBjg7DR5d:EM2G0av/GBZAM4Ad8WY4fhcBR
Threatray	3'669 similar samples on MalwareBazaar
TLSH	T18284E11BBAC240A1C2148F3BD3FF6F555B55DEA2F297D30B2C1902E9249B3E5BE44186
TrID	69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4505/5/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter	lowmal3
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

300

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

ORDER FUZETEC PO2311-000031.exe

Verdict:

Malicious activity

Analysis date:

2023-12-04 08:52:42 UTC

Tags:

stealer agenttesla

Link:

https://app.any.run/tasks/ff6e4d05-f351-48b3-972d-25b79eb4f04c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/462258/

Detection(s):

Win.Trojan.EmbeddedDotNetBinary-9940868-0

Win.Trojan.EmbeddedReversedDLL-9940922-0

Win.Trojan.Generic-10014419-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Creating a file in the %AppData% directory

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Creating a file in the %AppData% subdirectories

Reading critical registry keys

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Stealing user critical data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/656d9334bcca970107d92226/reports/2c0e1b31-a236-43a5-af91-f4b19ba8e5ff/overview

Verdict:

Malicious

Labled as:

MSIL.Androm.Generic

Link:

https://www.hybrid-analysis.com/sample/6d7ca76f65a253a1587d1f5a94d7ff27d0babf11b830fd778efb96ebd8196442

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3a610b39-45d4-4cc7-9bfc-b3a617ab5134

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1352962

Signature

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains functionality to log keystrokes (.Net Source)

Creates multiple autostart registry keys

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected Costura Assembly Loader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/6d7ca76f65a253a1587d1f5a94d7ff27d0babf11b830fd778efb96ebd8196442

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/6d7ca76f65a253a1587d1f5a94d7ff27d0babf11b830fd778efb96ebd8196442/

Threat name:

ByteCode-MSIL.Spyware.Negasteal

Status:

Malicious

First seen:

2023-12-04 05:30:33 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

19 of 23 (82.61%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=nv6ko33fujj2cwd5d5njjv77e7ilvpyrxayp254o7oloxwazmrba._file

Verdict:

malicious

Label(s):

agenttesla_v4

agenttesla

AgentTesla

0f6154350e73fcd971f98f7bf3fd43773edd1cca24c16d259a4c755958970332

AgentTesla

1eda1b310543e616e8b7b97e8e5f13597fb3a67ed9658b3daba2f49361563689

AgentTesla

4e38578b5c0bfa9b222837756d0c2387d218aaa990b47befb98571cec82f6b32

AgentTesla

8a0caf3a314acdd946e058b936136c755e7701c1384b1f632075c0bc8d958bcf

AgentTesla

915b5b0d16f54f50af35902863670a73a5ce5dfeabc25cfe3bfa23cc637651fa

AgentTesla

c1cb5a4a27cf88c43845d65d73c7ca0706b00f8c999301061b745ce922c1bd12

AgentTesla

e278ecca391be13103b9584a01fd2bbd4fabdfef4756e3870e48140a304894e2

AgentTesla

f8aa3880202328a119071117878db0c3b5dc03a5cae3cb16e00cd2353598a913

AgentTesla

+ 3'659 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/231204-ksqebsaa4y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run key to start application

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

4175241bd5f22822ed9c2f2fa14d11e6ec8a9df25a1d47dea00f9b5719c99ea6

MD5 hash:

f677508cfa3051c6050d52c46d733017

SHA1 hash:

cc463991cd8284e700877fb9717c10302e4b3180

Link:

https://www.unpac.me/results/17ab6308-9bf4-4c63-9423-d7c775e0b0a9/

SH256 hash:

dd424500e936067c637f8e43aaabf979d5e5685278848d0bdd16f35721eea122

MD5 hash:

968f2f7b6d3b4e5c27c9e90f91a21a2d

SHA1 hash:

bd97dd1710c0d38b8d14c4849da1986775da1679

Link:

https://www.unpac.me/results/17ab6308-9bf4-4c63-9423-d7c775e0b0a9/

SH256 hash:

8c5b2209ec54979a037bd586e9dcbe8fdbb5bd39d83c4c6d8c477f1db65b01ab

MD5 hash:

4eedc20cefe56527e2732cb8b19500e7

SHA1 hash:

8fa22595ff47c6629306e9dfbc090c65d04a0f20

Detections:

INDICATOR_EXE_Packed_SmartAssembly

Link:

https://www.unpac.me/results/17ab6308-9bf4-4c63-9423-d7c775e0b0a9/

SH256 hash:

3a2c25c081783ac2bc598df12211a769e2be8361fa52775bc737d0a38194ff95

MD5 hash:

8b851c6f4e5a94d7de480b3a52d23310

SHA1 hash:

238244a41e017a05d84a892d5dbe4cb949b6153b

Link:

https://www.unpac.me/results/17ab6308-9bf4-4c63-9423-d7c775e0b0a9/

SH256 hash:

3220f2e18f454bac107afcb18a9027bd6e57a7692d9972af500b3e0c33e6e209

MD5 hash:

6e53137dc24986ba8732ae0eca0aba01

SHA1 hash:

11812f140c1b62d822490865fc91f19070e9cbd5

Detections:

AgentTesla

win_agent_tesla_g2

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Agenttesla_type2

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Link:

https://www.unpac.me/results/17ab6308-9bf4-4c63-9423-d7c775e0b0a9/

Parent samples :

1be1eb3fc904fc5a9e9e555e3fa4a2b6a5a299917d5afa9a1570079195387fa3
6d7ca76f65a253a1587d1f5a94d7ff27d0babf11b830fd778efb96ebd8196442
8879bff7f26b389b8d375928fc6095a3847f8602e00822e3f2f67705e2d85cc0
80a2010e0a0ade699a0c4bc3d5f739491d4ea6ccf4abe39b8232ef39dc7aa430
90c7b6bd3fd954125e071fca9a96c398d2c7c337e150b79c3629285858dd476c

SH256 hash:

6d7ca76f65a253a1587d1f5a94d7ff27d0babf11b830fd778efb96ebd8196442

MD5 hash:

9abefcb71f2f6808adc286ac83f5ef2e

SHA1 hash:

8f83d05ef4d201ee7b6dbc50eff66018a816ff73

Detections:

Typical_Malware_String_Transforms

Link:

https://www.unpac.me/results/17ab6308-9bf4-4c63-9423-d7c775e0b0a9/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6d7ca76f65a2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/6d7ca76f65a253a1587d1f5a94d7ff27d0babf11b830fd778efb96ebd8196442

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_Reverse_DOS_header Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects an reversed DOS header

Rule name:	Typical_Malware_String_Transforms Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research

Rule name:	Typical_Malware_String_Transforms_RID3473 Create hunting rule
Author:	Florian Roth
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research