MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 757e9bf6a266487ce05be68f4f9342807237f1456ca700a5dfe9bb4c20ea287a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 16

Intelligence 16 IOCs YARA 15 File information Comments

SHA256 hash:	757e9bf6a266487ce05be68f4f9342807237f1456ca700a5dfe9bb4c20ea287a
SHA3-384 hash:	fb866848bf0cb63cd389f95416ef8112e16ea9704ac6293f3770aa7bb902a56b5e485bc1320d6e8239aeba639abedab3
SHA1 hash:	65274b65ec884a7c570af7016e6833b076008036
MD5 hash:	72f8f8ba865d527de4c9d334ded4a2b5
humanhash:	music-social-november-happy
File name:	xe7dm84qpDTAibD.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	733'696 bytes
First seen:	2024-03-11 13:35:25 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:v6FO1l36g9/j1nBn9AhXDPt2xouvl+4JPxhFn4wPll40AY08S4r3RCb9nqVUGM7:RN/j1R9CzPERJPh4qz5NtNCbw
Threatray	500 similar samples on MalwareBazaar
TLSH	T123F4020533ED4A68E9BB93F49434860147B9B62BB662E31F4EC0A0D99EB77414F02767
TrID	63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):
dhash icon	0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter	adrian__luca
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

321

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

757e9bf6a266487ce05be68f4f9342807237f1456ca700a5dfe9bb4c20ea287a.exe

Verdict:

Malicious activity

Analysis date:

2024-03-11 13:37:26 UTC

Tags:

stealer agenttesla

Link:

https://app.any.run/tasks/c95411e2-1a00-4748-99ea-cf32513fdf0f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/478553/

Detection(s):

Win.Packed.Generic-10022562-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Сreating synchronization primitives

Creating a process with a hidden window

Creating a file in the %temp% directory

Launching a process

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

Reading critical registry keys

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Setting a keyboard event handler

Stealing user critical data

Adding an exclusion to Microsoft Defender

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/65ef08d0f074ad892e51eb77/reports/b0ee4d47-dec9-43bc-a712-31d2e8e29f3d/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/757e9bf6a266487ce05be68f4f9342807237f1456ca700a5dfe9bb4c20ea287a

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b5d41a2f-5f65-49cb-924c-5f9c1cdc283c

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1404472

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Adds a directory exclusion to Windows Defender

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Scheduled temp file as task from temp location

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/757e9bf6a266487ce05be68f4f9342807237f1456ca700a5dfe9bb4c20ea287a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/757e9bf6a266487ce05be68f4f9342807237f1456ca700a5dfe9bb4c20ea287a/

Threat name:

Win32.Spyware.Negasteal

Status:

Malicious

First seen:

2024-03-06 02:09:14 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ov7jx5vcmzehzyc342hu7e2cqbzdp4kfnstqbjo75g5uyihkfb5a._file

Verdict:

malicious

Label(s):

agenttesla_v4

agenttesla

AgentTesla

8d52ad531a5b78fdb0795a14f972923a14f494f13531da24cff68c9446d80dfa

AgentTesla

92c2e29583a5387aaa8c516cb90679f79204fe6c6b599d728a3a2edd0d80c6d8

AgentTesla

aa0bb57cc545a3e7e234ef691f84ea8f2fc90f4e024a3addcc23d2f20a0e63e0

AgentTesla

f4f30e7141908e117623dcac4e9f98cee8287fab750a1d720bdba5350cad19c9

AgentTesla

+ 490 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/240311-qwaqyabh9w/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

d09994e5533629a78fac3ddf523ad9a488271c0ddc6c033d24d9fd132d89b200

MD5 hash:

0f49aa745b5c7e530c790f35e4bfdb70

SHA1 hash:

e6c74884bf0cfe51fc0f79cafc416ae0d59da306

Link:

https://www.unpac.me/results/cedd482a-5769-4cbc-9554-4f4dac42c7c8/

SH256 hash:

0824f83dec27b5f227a72ec2044079f72a85f8807d4e9585b88e39f7151e3c44

MD5 hash:

50030c1c01a172bfb7bd931edbd76ea6

SHA1 hash:

1f1e5566aa920e258ef0e7f88ed57e83f2aa6dd5

Link:

https://www.unpac.me/results/cedd482a-5769-4cbc-9554-4f4dac42c7c8/

SH256 hash:

7b40d27557a5da1ff1654fad3a3790c84dab6eb196c6ad1c5e1b386c0fdef921

MD5 hash:

70f6a08fcf94bb5b238db53e1e434f8f

SHA1 hash:

11388fa19a0d127af75e4262822cf1c00158c510

Link:

https://www.unpac.me/results/cedd482a-5769-4cbc-9554-4f4dac42c7c8/

SH256 hash:

04547a7f48508fefd40b774e1e95b1b062047479a22cf5bb697d024fac8014c0

MD5 hash:

e3d11e0394e7a09845d191c93802daf2

SHA1 hash:

0d0c326898f453f6f74666715ae5453a0b605a69

Detections:

AgentTesla

win_agent_tesla_g2

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Agenttesla_type2

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Link:

https://www.unpac.me/results/cedd482a-5769-4cbc-9554-4f4dac42c7c8/

Parent samples :

757e9bf6a266487ce05be68f4f9342807237f1456ca700a5dfe9bb4c20ea287a
2843aae844d0b90a78597dc383828ef6d67ecc6e3d5e689ca4567bc823383b72
a775277953ea0daab3cbec4aa2b37c5e0052172c05f7d4d0e8c39894c58fabe0
105c79d054029dcf3d38c5ba526dc7c111cc2e2e6fb2555a88c0820a6ba9eb52
1ba9c4dfbdfb55f6588c8887006f2851716eb6e53eb2bd1bccd591aa9e182da7
8d4a83437f552b1737a406be9d9b5e4f4919a1adbf8e13f8261411d7390d604f
550bcd716d25eeb3be5bd9aa4686f89fa2d65d4a719eedaefcb289c1b823337e
c93baa6b0f81a26164837826fcfc1dda9fe2e4be3dd88caa1a4e5052090ac63d
3a066a770eabfe2d33e16ab8afc4ee5e045f704a76848ce6567812c5a8ffb268
2411819c88740710cbd55f64cfe89e6db250ad889d3771ec970e92bbe2be33b3
a423d20538a3ed387be79e95ac7b33d017544c2107436cf9ba4c30cf3cc67965
2ca9893654a57c02b54ad128cb00cc1628c7429add4adb17de2ce83d00bb1d44
20e319cbc410d4fd3ebd6f460ddfc541bf433a68c42605b0b2f375f95a222053
f32b7b888c9108e31cf98ffe866212158599a78e6af69d89528adac3d1ec92b0
83f0dc25e418c73327ff6b6429540818fad0eb5e7f557c6f68775546a0a5e215
eedfb4aa8784f4f2b221e4e3ab6058045a6575b8f4ee0f33d03c2dd93a8f7789
f94c37b31129800a833c257ea462132b658bf7e9d1e71481921475edcfec743c
4aa8c3730495daa1c3fbc49c5e2e4f58cbfa2277252397341d96f54ba1bca1b1
03665ef38e9753bab4a9f071bfd6fb52426fa14dbe9d55f019b7cead8bcbacfb
adc2acae5418e1a06d043121ebd3d526cf68c326be9ffa956517d6a887f63a0b
2eee8050f8bf737e67356837dedc9ccd415011df20ed2b14f6743ecbf265d3d1
f59e38b11dd3fe8892f365d290641c9198c4e86e13e4768f88f9cffa79d23d92
daa69f6b826aee3b3949e40f993f10a5f30faf0834985039cbfa21d20029f0a1
fa3157e7c4a98fa03ae41b01f7832b81cd35015d7bead4e335262e2211f79f79
d89ea6a01347b82f963ed7960583e5d76c6a07e91852fae83bc290e0f64a06b2

SH256 hash:

757e9bf6a266487ce05be68f4f9342807237f1456ca700a5dfe9bb4c20ea287a

MD5 hash:

72f8f8ba865d527de4c9d334ded4a2b5

SHA1 hash:

65274b65ec884a7c570af7016e6833b076008036

Link:

https://www.unpac.me/results/cedd482a-5769-4cbc-9554-4f4dac42c7c8/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/757e9bf6a266/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Generic_Threat_9f4a80b2 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

exe 757e9bf6a266487ce05be68f4f9342807237f1456ca700a5dfe9bb4c20ea287a

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/478553/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample