MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70786a83bfa0b84514ea47447505e87fe3a2daa1357f1ab76b864039d33c0fe8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 24 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70786a83bfa0b84514ea47447505e87fe3a2daa1357f1ab76b864039d33c0fe8
SHA3-384 hash: cf1d5bed13ef35eaff6c846e4019b71a40c489d2d0053613d01b535627f41f65ac3aeb5a7529fe08f530d55443a4ed1c
SHA1 hash: 0cc7c1dad6ad2330cd9e4a80696a1b1d7948d2d4
MD5 hash: c7069f161b5e41daa4944dfb7e3d03fa
humanhash: alaska-bravo-texas-nineteen
File name:OC 005197.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'048'576 bytes
First seen:2025-03-24 12:19:29 UTC
Last seen:2025-03-24 12:21:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:Hu6J33O0c+JY5UZ+XC0kGso6FaAjLg3ASlchRmWY:Bu0c++OCvkGs9FaAhsch7Y
TLSH T18325BE2273DDC360CB769133BF69B7016EBF38614630B95B2F980D7DA950162262D7A3
TrID 32.2% (.EXE) Win64 Executable (generic) (10522/11/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4504/4/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
386
Origin country :
HU HU
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.vh.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67dae2d7115e7b48b48ebb84
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context autoit compiled-script evasive fingerprint formbook keylogger lolbin microsoft_visual_cc packed packed packer_detected reg
Link:
https://www.filescan.io/uploads/67e14e17c26eb3fd74f53240/reports/d0bc10e5-008a-41bb-8c7b-0fc63e6feaba/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/70786a83bfa0b84514ea47447505e87fe3a2daa1357f1ab76b864039d33c0fe8
Result
Verdict:
MALICIOUS
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1647046
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/70786a83bfa0b84514ea47447505e87fe3a2daa1357f1ab76b864039d33c0fe8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/70786a83bfa0b84514ea47447505e87fe3a2daa1357f1ab76b864039d33c0fe8/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-03-19 15:29:28 UTC
File Type:
PE (Exe)
Extracted files:
27
AV detection:
29 of 36 (80.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ob4gva57uc4ekfhki5chkbpip7r2fwvbgv7rvn3lqzadtuz4b7ua._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
unc_loader_036
Create hunting rule
Similar samples:
error
AgentTesla
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery keylogger spyware stealer trojan
Link:
https://tria.ge/reports/250324-php32atjy9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Looks up external IP address via web service
AgentTesla
Agenttesla family
Verdict:
Malicious
Tags:
trojan external_ip_lookup
YARA:
SUSP_Imphash_Mar23_3
Link:
https://app.threat.zone/submission/c046e754-59ca-43c2-b946-1437113c1a5f
Unpacked files
SH256 hash:
70786a83bfa0b84514ea47447505e87fe3a2daa1357f1ab76b864039d33c0fe8
MD5 hash:
c7069f161b5e41daa4944dfb7e3d03fa
SHA1 hash:
0cc7c1dad6ad2330cd9e4a80696a1b1d7948d2d4
Link:
https://www.unpac.me/results/c79e77a2-904a-4085-afec-385a03b60dba/
SH256 hash:
d11f7bb1201fa8666a87e1dd5564bef288c868f9cd3d4d1ab18c381ca6ad3a78
MD5 hash:
1714efb0f74f6155a248a933e91357ad
SHA1 hash:
7a8ede062f25a6b0f81e9a496e633f33f2832b81
Detections:
win_agent_tesla_g2
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
Link:
https://www.unpac.me/results/c79e77a2-904a-4085-afec-385a03b60dba/
Parent samples :
11ee801f67fc5108cb0e36b3a91405b2a83e86d8de457225cd14292eb46e19e7
2423cbba54e73aee0fcc5914484f01f2f11684cdde5a3a07681d0d3fed59aa36
787fad37efb7d8a1da898dc229a32211a3de0145815b7f0c46a7d5f74046fa35
30d91ef269ca652f181ba1985cf2cf8a5790305927c6887e0c298c38ae87afcf
c40c36978fc01bcbd7eca78bb7b5689b7460bbe7ef122cc2a2cde6fc415d24e0
4fb5281d2ac2e31416f64aa0ddcece35ac2ebea9fbe503dfdc8036a1289403ca
da66e29c9666cf148014ef6794b6f02ca30d3e08188c57487d21e2e05d260b68
c254f01dadf304302e5f3398c2d27d3f68f20119e35e9774037ada01dce922ea
d11f7bb1201fa8666a87e1dd5564bef288c868f9cd3d4d1ab18c381ca6ad3a78
adb52449dd91168825ddfbfc214838688e63eb9d2d66191b2d99fd3c63ab2592
576a8ef62a3aa573eeb32128100bba673c0c967abf51ece921781608e13fbbd0
b9c9fd099abaad643515c86e4c5db4e6f62d008fb4e7b9b2cd407f050dd33119
8310d68a7f689fa70a20da444f64e6694c5513be2839a2fc88aac159d064a38a
2cb274eea982562d847d3c6674f6a07584c2f66cb203b9fd4fd710074357ba1e
2fdf4ec52e749c2048c0b85fba9cf8df15eafb94453d758bdca13a65140185fd
23699ad43e832923b83bc820adb52b17eb5bee5720129720d51a386fe9d59cac
66d03b788fb30b48ae88976c7f558f4da002665d2c493914addf9449126b9daa
15c74162d5e448d5691900c39f7c8c9939204bcff280eb316fdd6802a3a28f3a
7dd88bb379949c90207a5d476d7318ba98ccb6cb7853409c6d323febd28d318d
4f338449a4fa2e63dbc9aac4d96e4a4d47aacc96ea5fe62ef55301a464be0dcf
5420f805940014cf9e51372725194209e75017aaa65c73673ceab6751784fe1d
309c72a0cfc3bd2a848c978921abe215da76dd3aa38f3221d28cb6524c35ba85
f11a80123a901473bc7a5dabdd51847e6adbda96280dec8442fd2ef96cce42af
70c57e0ebfbae88ab7a75a250ae1618de974bff18b1c91f9800cdd399bd59561
721490f6523a38a63d64f8d266f32be5cd9f4140f1bb2577fa7b579b105ac37d
af97c20ead714a7ffc48993c9655ea0fb2264f927fd5d66403d22877ef197495
dc2d55de6e5316aeb72b22bf425e9eab82adbb48247f8f8bb8e8e4644ec191b0
ce0b9b24b5c1d33c48d8eb08ff59cc8b7d529a1366219f60ae80c1eafb3801ad
1e8ed2a1de9da3023bb2804b5e7baacedb1056bf93710f0e1edc1697c5f8f38a
62d2a947027c152346af07520fc7e0596c38460e19548a4ca1cb4f897b50290e
98b15e40059c4708f31e44f14f547f4533c32c117efb71c7cef9bc3aca253c72
70786a83bfa0b84514ea47447505e87fe3a2daa1357f1ab76b864039d33c0fe8
66d7d602350b27bd25ca73436b6b7598c65e5022cc8062eb5c87dc604ab97952
f36ccfca37c4131f7407665c75597630bb1df079a055dba2b8ee3321bcdbaa00
2d096b77a85732091954e941e842e3518cda30e2ae75c64e68f893bb5bd14b46
b29185ff9cbbe7ce8b9016966964c905df26b69f97ec6c7adb42df0dd3b31fc5
19bc958cc02a866392afaac8e9d5d5887ee5361b16908ace45d64dd7e4546350
4860d655679f0a13c8710e4f4f273421ea3ac90c5ffc1f3a7d61d3a4a6b46ae9
572a8143626c3ba4a47ab7ddb26146c0de475ab3a0f405193305348cbc02603d
86a32cb0fb642641f2b04987043472edaa31b283c437a64c9e0fb7a549ac10a5
6f853fefc8f4fb4e4b5985f40f6180278ca10b8904c887f93c86b32b7b77b844
bee44d25e7798f6d4364e452633610b0656d76bc5c1577eced9a40554f53a04a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/70786a83bfa0b84514ea47447505e87fe3a2daa1357f1ab76b864039d33c0fe8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV2
Create hunting rule
Author:ditekshen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:AgentTeslaV5
Create hunting rule
Author:ClaudioWayne
Description:AgentTeslaV5 infostealer payload
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Windows vault credential objects. Observed in infostealers
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:MALWARE_Win_AgentTeslaV2
Create hunting rule
Author:ditekSHen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_Imphash_Mar23_3
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:Internal Research
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Generic_Threat_9f4a80b2
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_AgentTesla_ebf431a8
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 70786a83bfa0b84514ea47447505e87fe3a2daa1357f1ab76b864039d33c0fe8

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::CopySid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::GetAce
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileExW
KERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
IPHLPAPI.DLL::IcmpCreateFile
KERNEL32.dll::CreateFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments