MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74184f7d76c799408c51a411c56eaaeab7adbf28a16cc3729bb0e96f11b55488. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74184f7d76c799408c51a411c56eaaeab7adbf28a16cc3729bb0e96f11b55488
SHA3-384 hash: 8f5b1ee8a612dec59692c658b39e627b5bec2caf625471e546a1d713748958dbf88ecdecb885413d994a251ddbe5699d
SHA1 hash: 11bff10fed10f1e41ffa54b4869cbd2a608a707d
MD5 hash: fa74159f7f6330f3233ce5d73ab76c6b
humanhash: early-march-washington-stream
File name:SecuriteInfo.com.Trojan.Inject4.59820.17792.11079
Download: download sample
Signature AgentTesla
Create hunting rule
File size:628'224 bytes
First seen:2023-12-11 11:17:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:QQz7XVe7A1JGR6BWdBJR2aDFFNphbZ79aQmbCp1C:QQzmYILX2aD9L
Threatray 2'145 similar samples on MalwareBazaar
TLSH T1D3D41289335DC757E23E97F649A2222003F5215EA471E7682EC2A6EF2479F400B54F6F
TrID 61.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.1% (.SCR) Windows screen saver (13097/50/3)
8.9% (.EXE) Win64 Executable (generic) (10523/12/4)
5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
270
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/465020/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Inject4.59820.17792.11079.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Sending a custom TCP request
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6576f023bb9490c89ccd00e5/reports/bec2afdd-c444-48fd-a6d8-4d2f3317d158/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/74184f7d76c799408c51a411c56eaaeab7adbf28a16cc3729bb0e96f11b55488
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0d5c1222-b12b-438f-9544-22404ee6cdc9
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1358279
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/74184f7d76c799408c51a411c56eaaeab7adbf28a16cc3729bb0e96f11b55488
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-11-28 08:21:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
18 of 22 (81.82%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oqme67lwy6mubdcruqi4k3vk5k323pziufwmg4u3wduw6envksea._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0972105c3cb2d74e7cb3f00ddcc6cc96089524d5625b62f71e27d5857c6eba40
AgentTesla
1e2ee43e269f7144725650607d8055ecc9dce77dde8fd13fc25fb4c85c0055b0
AgentTesla
436f74f3d2537685ed53a9a83ae70cc1a98e987d90ba949ca879a854e2970ed9
AgentTesla
493e3d54159cd3ebde6aa0b5216ddcb14863b4b064bb80c654353838926d191d
AgentTesla
c073d55e30e424b99d07e376c38ca35b579dbd327da6be96cec527b0e3132ccd
AgentTesla
d3729ee774783f9a15211e79e021238418c97d4625631368f7c2e187678ba72a
AgentTesla
d8237144bdf583bd62c89733eb04397c906d68f072ab35d379917482a7178782
AgentTesla
e579952e0a6c558c001274aa13e6ac8297a3991497f0163917e6db3a37430f83
AgentTesla
+ 2'135 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/231211-nen6wsdbbp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
bcaef0e069cb2cbe0fc9b4283907d54ee6473010d7d4f4f0631d21e9e0b8b990
MD5 hash:
598a72b6432aae3aece3da8eda0043f3
SHA1 hash:
f8f975cca6872dc971cf1ac0497bd6446428c9b5
Detections:
AgentTeslaXorStringsNet
Create hunting rule
MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
Link:
https://www.unpac.me/results/f1a51e45-0759-4013-a62c-da9d5f25afaa/
Parent samples :
721cd7be724330f00dce933ea88b8a6abda0f2e83543a6c0f5bf0ce3754ccdbd
ec2832608abf213a2a622dba1ec894e80b2adfc3d0eb03ee783fa2df47dc6bf0
fb2945c4344dbf6a9de214dcb4fcc52ab7b039b17b2ab924558eb08f8fd13c71
05220984bed944b5743d4a9b640a42788d53ef523a8f9dc81c983b9da74eb6da
8573f0b0ca38799192fa3c6d6bfc928a2f1383f529e65c43f8c324b825735bd5
fe0dc5415b9e4a0aaab85349ca18704f10b02a3f5fe6de959b3e39d12a9a07a2
d6497995d3f65551d193a651e10534d71d249b8e722290bc3c1f0fd4f7156c72
74184f7d76c799408c51a411c56eaaeab7adbf28a16cc3729bb0e96f11b55488
SH256 hash:
9b4782435f360ecc5faeb31e402c8ec44057a57b28073419aa8379a3c33c2c93
MD5 hash:
ccd0bcc6cc01923e5ddf4ba72fc8fa12
SHA1 hash:
f2d4bd262aa5a6e2cf439488c1cae3968ab8d34a
Link:
https://www.unpac.me/results/f1a51e45-0759-4013-a62c-da9d5f25afaa/
SH256 hash:
f5a8f5ded618fd3989fa98a3c2d87c4853d6e10ecb1313cd5ddd7df375336b31
MD5 hash:
243f9990bb7d68a3f6e4d3999800da5b
SHA1 hash:
ba555175d12f19f6288a3574738bcd6c8b747e3b
Link:
https://www.unpac.me/results/f1a51e45-0759-4013-a62c-da9d5f25afaa/
SH256 hash:
8510982547288c4155eebcd9fe623fac7abb78d6925cd2491663523fd8b0ea17
MD5 hash:
813726b0f7736511bb44045fec5c42e0
SHA1 hash:
6d3bf7cfc8a2ffd8ada7c75ddb203401dbd7ad55
Link:
https://www.unpac.me/results/f1a51e45-0759-4013-a62c-da9d5f25afaa/
SH256 hash:
74184f7d76c799408c51a411c56eaaeab7adbf28a16cc3729bb0e96f11b55488
MD5 hash:
fa74159f7f6330f3233ce5d73ab76c6b
SHA1 hash:
11bff10fed10f1e41ffa54b4869cbd2a608a707d
Link:
https://www.unpac.me/results/f1a51e45-0759-4013-a62c-da9d5f25afaa/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV4
Create hunting rule
Author:kevoreilly
Description:AgentTesla Payload
Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:msil_susp_obf_xorstringsnet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_AgentTesla_a2d69e48
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/465020/

Comments