MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a06d8aeb3e91c50bb2b2ae3e309fcbc2a01e7871c834508273401ffeb806359. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a06d8aeb3e91c50bb2b2ae3e309fcbc2a01e7871c834508273401ffeb806359
SHA3-384 hash: 9779d5b7abf7c46a7e2ba581e2e57fc2f35a6b6c5f9d2a7c8f617ca0dbf4e6148220800478c0759427cf2d9ccaa6bf73
SHA1 hash: a05d1dbb89ffd70c9f38a263355817650d09ecf5
MD5 hash: 17c3bbffc1bd127c4ce726f4b40791ad
humanhash: burger-whiskey-network-romeo
File name:Purchase Inquiry.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:686'080 bytes
First seen:2023-05-04 07:35:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:aOBoVOxnueUElgvvxsXxs2egQVtb/iWlui8YjJMhqrLF46C7YBmmF1118r/tvDfp:OO3UElyshsx/HuL8rLF46C7YomF111OT
Threatray 2'948 similar samples on MalwareBazaar
TLSH T1B9E48C569014C82EFE56EB71C1B5FFE4A6F1FD7394D5142227793888EAB9F021E8C128
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 8e173733330f693b (14 x AgentTesla, 4 x Loki, 2 x njrat)
Reporter Anonymous
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
248
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Purchase Inquiry.exe
Verdict:
Malicious activity
Analysis date:
2023-05-04 07:38:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3577ec45-94f6-4aa5-981b-f6943a168086

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/386397/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Sanesecurity.Rogue.0hr.20230428-0734.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6453606216ef4c6656576d1e/reports/2a5f0d6f-c4e1-4af2-9a0a-5bdf418ce135/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/7a06d8aeb3e91c50bb2b2ae3e309fcbc2a01e7871c834508273401ffeb806359
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/45587d64-109f-4a87-a49c-d756bc19b3c1
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1225865
Signature
.NET source code contains potential unpacker
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7a06d8aeb3e91c50bb2b2ae3e309fcbc2a01e7871c834508273401ffeb806359/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-04-28 01:51:30 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
26 of 37 (70.27%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pidnrlvt5eofbozlflr6gcp4xqvadz4hdsbukcbhgqa7724amnmq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1714dd405b8a79815639835e9f5fd074b7a1952fe41032cb520b5046bf627eed
AgentTesla
60b3645a7d02232fd97ba076bdb88e6a801f462ce972d79366df9261a9f62720
AgentTesla
878f78260ff0cc10af5b6aef90f7352b83dd20db8394db7ba06bb3230a54e674
AgentTesla
89a2b28ad32817e9be0489ae7fa0a9134f0f0b38f2e93f74c24e9278492ddb5a
AgentTesla
a9b98a60cb56ec8b3b05c5ebe0656afb6f42a5cb296c8c4fb2dccc283a2fe082
AgentTesla
b81b5d7a927299cc54748988d70523c615e82e21482652510a1a95db89b3521d
AgentTesla
c89bf6380445a49127491a4c68b77bc9ff8ba9b8fa016846ed6cc2274b6133d0
AgentTesla
cdca513e22701403a62e153f5d197a4d7e3f0fb3ed18f66021e00b7b3720713a
AgentTesla
+ 2'938 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230504-je8s3saf66/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
af0925e4c632166ff87032bc43ea4f85a3805db3782a49724d125f44c0731114
MD5 hash:
b9897ba5e468e516e162fd3790a9ddbc
SHA1 hash:
db264c796e4a36a45af11e8a7bf71cf0dadce0f0
Link:
https://www.unpac.me/results/518f3e6e-92dd-4bd6-87a3-6c844a7a4b4e/
SH256 hash:
1b2faa2988ccdb87279653b2c0913f427df02533f5e9b607af0b64111ba1f525
MD5 hash:
f51d8526e24863e441912383617e372e
SHA1 hash:
d086875e00d51847ceb3584b5e5fb56f5ac4e0cb
Link:
https://www.unpac.me/results/518f3e6e-92dd-4bd6-87a3-6c844a7a4b4e/
SH256 hash:
c8808b69b0f4d52c253e35b001da94086786b34162fd51daa3f17eda94bac7f0
MD5 hash:
da56041df789c24cb2a36a364431f766
SHA1 hash:
876e6c579d1092a76ce90c500c43af0cf11724a4
Link:
https://www.unpac.me/results/518f3e6e-92dd-4bd6-87a3-6c844a7a4b4e/
SH256 hash:
368c23b8f53edae9a370cb824f1f29f4d858a80ce2c97a3ebcd77638be254221
MD5 hash:
b8abe40b03f90d8f3f94146bbff4b9a9
SHA1 hash:
70c9f319e3f7a54600a064c0858ee49db103356c
Link:
https://www.unpac.me/results/518f3e6e-92dd-4bd6-87a3-6c844a7a4b4e/
SH256 hash:
b8ed60ebe81d728b8d17bd585958b95ed8c94fbce6a3e65a498926ed6fec1561
MD5 hash:
b30d7335e5c210f1e8159421bb8d08f7
SHA1 hash:
3528a5130d2cbb7190937ea9289ab8d5747e9596
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/518f3e6e-92dd-4bd6-87a3-6c844a7a4b4e/
Parent samples :
a9b98a60cb56ec8b3b05c5ebe0656afb6f42a5cb296c8c4fb2dccc283a2fe082
89a2b28ad32817e9be0489ae7fa0a9134f0f0b38f2e93f74c24e9278492ddb5a
1714dd405b8a79815639835e9f5fd074b7a1952fe41032cb520b5046bf627eed
30a821884a0ebea379cb9130bf94168aa04e115baa74b63bec5aee4d8dbfc62f
7a06d8aeb3e91c50bb2b2ae3e309fcbc2a01e7871c834508273401ffeb806359
SH256 hash:
7a06d8aeb3e91c50bb2b2ae3e309fcbc2a01e7871c834508273401ffeb806359
MD5 hash:
17c3bbffc1bd127c4ce726f4b40791ad
SHA1 hash:
a05d1dbb89ffd70c9f38a263355817650d09ecf5
Link:
https://www.unpac.me/results/518f3e6e-92dd-4bd6-87a3-6c844a7a4b4e/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:msil_susp_obf_xorstringsnet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 7a06d8aeb3e91c50bb2b2ae3e309fcbc2a01e7871c834508273401ffeb806359

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/386397/

Comments