MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76d408f5bf2d502b7118d0af045f6a7cc9faf8316a304887298f011521badb32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76d408f5bf2d502b7118d0af045f6a7cc9faf8316a304887298f011521badb32
SHA3-384 hash: b24eee8cf2c271a664d45b6e69968054bd7d4a79ef10608a1ae2c5ef92c1b8adb3f50a7b18f8fa57aa06458c662e4207
SHA1 hash: 08ed3edae4eac09c8e08663c48239da686d78963
MD5 hash: bdb3bf93d494ecbac917008a8b4281a9
humanhash: queen-hawaii-kansas-saturn
File name:SecuriteInfo.com.Win32.TrojanX-gen.29504.9518
Download: download sample
Signature AgentTesla
Create hunting rule
File size:772'608 bytes
First seen:2023-07-06 05:29:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:+z+Ijhnjht249VGPSCWG0s8vpHQZ0SNLV9mbf2ky8p71zg5:+zTNnNtjODT8BH8Nh1LS1z
Threatray 275 similar samples on MalwareBazaar
TLSH T12FF48C3C18BC7622C174F6F68F9CC425F690946A3E61CE3769C39899461EE0265C7E3E
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
274
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.TrojanX-gen.29504.9518
Verdict:
Malicious activity
Analysis date:
2023-07-06 05:31:04 UTC
Tags:
agenttesla
Link:
https://app.any.run/tasks/d3734eba-e0e6-4737-a71a-50a73d71a69e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/408723/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.29504.9518.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Launching a process
Restart of the analyzed sample
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/64a6515ca19f5dcc59aa0072/reports/22ab8b3d-2d16-429a-a2a2-3125ead1db61/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/76d408f5bf2d502b7118d0af045f6a7cc9faf8316a304887298f011521badb32
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c76aa05f-5ada-4642-9300-cc7bd930d265
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1267756
Signature
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1267756 Sample: SecuriteInfo.com.Win32.Troj... Startdate: 06/07/2023 Architecture: WINDOWS Score: 100 51 Snort IDS alert for network traffic 2->51 53 Found malware configuration 2->53 55 Sigma detected: Scheduled temp file as task from temp location 2->55 57 5 other signatures 2->57 7 SecuriteInfo.com.Win32.TrojanX-gen.29504.9518.exe 7 2->7         started        11 tcfLqfyej.exe 5 2->11         started        process3 file4 33 C:\Users\user\AppData\Roaming\tcfLqfyej.exe, PE32 7->33 dropped 35 C:\Users\...\tcfLqfyej.exe:Zone.Identifier, ASCII 7->35 dropped 37 C:\Users\user\AppData\Local\...\tmp5DC1.tmp, XML 7->37 dropped 39 SecuriteInfo.com.W....29504.9518.exe.log, ASCII 7->39 dropped 59 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->59 61 May check the online IP address of the machine 7->61 63 Uses schtasks.exe or at.exe to add and modify task schedules 7->63 65 Adds a directory exclusion to Windows Defender 7->65 13 SecuriteInfo.com.Win32.TrojanX-gen.29504.9518.exe 15 2 7->13         started        17 powershell.exe 20 7->17         started        19 schtasks.exe 1 7->19         started        21 SecuriteInfo.com.Win32.TrojanX-gen.29504.9518.exe 7->21         started        67 Multi AV Scanner detection for dropped file 11->67 69 Machine Learning detection for dropped file 11->69 23 tcfLqfyej.exe 14 2 11->23         started        25 schtasks.exe 1 11->25         started        signatures5 process6 dnsIp7 41 strictfacilityservices.com 111.118.212.38, 49697, 49699, 587 PUBLIC-DOMAIN-REGISTRYUS India 13->41 43 mail.strictfacilityservices.com 13->43 49 2 other IPs or domains 13->49 27 conhost.exe 17->27         started        29 conhost.exe 19->29         started        45 mail.strictfacilityservices.com 23->45 47 api.ipify.org 23->47 71 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 23->71 73 Tries to steal Mail credentials (via file / registry access) 23->73 75 Tries to harvest and steal browser information (history, passwords, etc) 23->75 31 conhost.exe 25->31         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/76d408f5bf2d502b7118d0af045f6a7cc9faf8316a304887298f011521badb32/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-07-06 03:09:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
16 of 24 (66.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o3kar5n7fvicw4iy2cxqix3kpte7v6brniyerbzjr4arkin23mza._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
47c89c8b504cdbd28b1e573025fc005b8a89fe4e7e6d61a608921881f41a7f44
AgentTesla
5afc34ba8d87868898a975c8a82a6817739d9ff294fae609b2ca293ac5e478a6
AgentTesla
b79d3384f353bf024148b984f6d96e272c30b7547a00fb5d6f05524dbcc435a8
AgentTesla
c5a6df42235a175be31fec2a8eae40ba6263d48a207debbe1c4cde98861182c8
AgentTesla
d6f97400d822eaccbf90e7a0dc62b32e8073ad22185c28c065eca47bda82e044
AgentTesla
f32fa75689c2875fc313105007b2b9ca1080cb75de4da9b58f2e3ccdb178ac1d
AgentTesla
+ 265 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230706-f66agsgh62/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
SH256 hash:
83c1537a2bbc93c547053677b71fd673e4c40266fda7c784df3fe029099e4f66
MD5 hash:
3ab2434180d8ec0e31fbc94b0bda824f
SHA1 hash:
64f7f39f0f8aacfce082d313b4b0fb7da7e249cd
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
Parent samples :
d2b353f0773053cc50fe7bca95b1e3371d83a3bfc5de8c5d4af5f1aa62692522
76d408f5bf2d502b7118d0af045f6a7cc9faf8316a304887298f011521badb32
97a5bd6e8db244df556494aab5ed311e7ee08bc2cb2efc711a6cf744613985fe
4e7bb77954afbccdc27b8a44ef59bbe072f3fc18966a8b52495306911e2dd59b
ae9099be0608cb2dea5b267620f7e0089bd21a51b0fcf25175a458a1f6f9b113
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
SH256 hash:
a228db0eaea48305e590e5fc58e50fd082a4fc4712326399d8fd8f0ac0326d05
MD5 hash:
e2f342f7be77d6fc0b81d1c9101ec8e9
SHA1 hash:
433990e2504a205729098f4d9ebd0ea4f7b9cc3a
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
SH256 hash:
83c1537a2bbc93c547053677b71fd673e4c40266fda7c784df3fe029099e4f66
MD5 hash:
3ab2434180d8ec0e31fbc94b0bda824f
SHA1 hash:
64f7f39f0f8aacfce082d313b4b0fb7da7e249cd
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
Parent samples :
d2b353f0773053cc50fe7bca95b1e3371d83a3bfc5de8c5d4af5f1aa62692522
76d408f5bf2d502b7118d0af045f6a7cc9faf8316a304887298f011521badb32
97a5bd6e8db244df556494aab5ed311e7ee08bc2cb2efc711a6cf744613985fe
4e7bb77954afbccdc27b8a44ef59bbe072f3fc18966a8b52495306911e2dd59b
ae9099be0608cb2dea5b267620f7e0089bd21a51b0fcf25175a458a1f6f9b113
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
SH256 hash:
a228db0eaea48305e590e5fc58e50fd082a4fc4712326399d8fd8f0ac0326d05
MD5 hash:
e2f342f7be77d6fc0b81d1c9101ec8e9
SHA1 hash:
433990e2504a205729098f4d9ebd0ea4f7b9cc3a
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
SH256 hash:
83c1537a2bbc93c547053677b71fd673e4c40266fda7c784df3fe029099e4f66
MD5 hash:
3ab2434180d8ec0e31fbc94b0bda824f
SHA1 hash:
64f7f39f0f8aacfce082d313b4b0fb7da7e249cd
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
Parent samples :
d2b353f0773053cc50fe7bca95b1e3371d83a3bfc5de8c5d4af5f1aa62692522
76d408f5bf2d502b7118d0af045f6a7cc9faf8316a304887298f011521badb32
97a5bd6e8db244df556494aab5ed311e7ee08bc2cb2efc711a6cf744613985fe
4e7bb77954afbccdc27b8a44ef59bbe072f3fc18966a8b52495306911e2dd59b
ae9099be0608cb2dea5b267620f7e0089bd21a51b0fcf25175a458a1f6f9b113
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
SH256 hash:
a228db0eaea48305e590e5fc58e50fd082a4fc4712326399d8fd8f0ac0326d05
MD5 hash:
e2f342f7be77d6fc0b81d1c9101ec8e9
SHA1 hash:
433990e2504a205729098f4d9ebd0ea4f7b9cc3a
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
SH256 hash:
83c1537a2bbc93c547053677b71fd673e4c40266fda7c784df3fe029099e4f66
MD5 hash:
3ab2434180d8ec0e31fbc94b0bda824f
SHA1 hash:
64f7f39f0f8aacfce082d313b4b0fb7da7e249cd
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
Parent samples :
d2b353f0773053cc50fe7bca95b1e3371d83a3bfc5de8c5d4af5f1aa62692522
76d408f5bf2d502b7118d0af045f6a7cc9faf8316a304887298f011521badb32
97a5bd6e8db244df556494aab5ed311e7ee08bc2cb2efc711a6cf744613985fe
4e7bb77954afbccdc27b8a44ef59bbe072f3fc18966a8b52495306911e2dd59b
ae9099be0608cb2dea5b267620f7e0089bd21a51b0fcf25175a458a1f6f9b113
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
SH256 hash:
a228db0eaea48305e590e5fc58e50fd082a4fc4712326399d8fd8f0ac0326d05
MD5 hash:
e2f342f7be77d6fc0b81d1c9101ec8e9
SHA1 hash:
433990e2504a205729098f4d9ebd0ea4f7b9cc3a
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
SH256 hash:
76d408f5bf2d502b7118d0af045f6a7cc9faf8316a304887298f011521badb32
MD5 hash:
bdb3bf93d494ecbac917008a8b4281a9
SHA1 hash:
08ed3edae4eac09c8e08663c48239da686d78963
Link:
https://www.unpac.me/results/fcd8537b-c5e9-48d6-9610-65ee3ccf254b/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/76d408f5bf2d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76d408f5bf2d502b7118d0af045f6a7cc9faf8316a304887298f011521badb32

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/408723/

Comments