MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d96be8384a49ede03c11eaece2a984311fb693507fbbe38d6f9882685e5386a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7d96be8384a49ede03c11eaece2a984311fb693507fbbe38d6f9882685e5386a
SHA3-384 hash: 3b340f396912445be81be75e1e5ed8ea2034fbd46574782df38a5d0db8c3d6cc6d7e113f502d4a68745165b1801abb75
SHA1 hash: ea18ff0d6a5a7ee730bd4f6d2b22215696bffccd
MD5 hash: 6cdc84b7e74246fa9ad8587f7b9a23e8
humanhash: queen-fourteen-social-princess
File name:Purchase Order List Requirements 20230227938823 PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:743'424 bytes
First seen:2023-07-10 14:04:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:8J4axp7tL+Naaq8WuWhV2wUFF247aqbE8xy+pzqTf9WEpOaCfrsViejAj08DqvPp:0p5kqKWKxFb7Ng+BqTIoOaOsViej1t
Threatray 365 similar samples on MalwareBazaar
TLSH T1F7F4F126B1BFDB47D9B573FE5808184437F8891D8A70F3185C8B61FA0A7AB444984EDB
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
292
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Purchase Order List Requirements 20230227938823 PDF.exe
Verdict:
Malicious activity
Analysis date:
2023-07-10 14:07:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6057e926-e2ec-4bef-b7d1-775be289f746

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/413933/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader45.60853.27245.18549.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/64ac100f9bd9f933fbb9420e/reports/481f2018-1c0b-4ff6-aca2-b4acd3992289/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/7d96be8384a49ede03c11eaece2a984311fb693507fbbe38d6f9882685e5386a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/0e6bb528-1dd4-4f6e-9eb5-c95a4cfdc91f
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1270014
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7d96be8384a49ede03c11eaece2a984311fb693507fbbe38d6f9882685e5386a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-07-10 11:43:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
27
AV detection:
24 of 37 (64.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pwll5a4euspn4a6bd2xm4kuyimi7w2jva7534ogw7gecnbpfhbva._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2c3d16e1c28e192249da7fc79bc4fc2ed1508610627e82ca96c50083f4e0d9ed
AgentTesla
367fb0e0d122f5eabd8d344d27bd9f3aea9ed0959b5186e54ec18137a2854cc7
AgentTesla
65acc93f4a502f7efbe10313ed41bc436425ebe172f3974883f0ecb6d2ecbf3c
AgentTesla
71c93b4b1cef4f5c4f562ea58850fc63f945c4f7932f0d78d7912fbbf1fa1cee
AgentTesla
9f8dd7a2f5e56970c9e6aa9af1c62b9d1d2ee03ca5dc33f9d6d376edd3bc0cdd
AgentTesla
a771e432eb0dce654681e18c337cafbbedc875bd918198762933dd9d7d8772c7
AgentTesla
db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb
AgentTesla
dc7f9c2cbc0466c884b6fcfa3430a74b2e582446e4560133495cabb5ce05c940
AgentTesla
e5fe74a699fdee524980b0ccdfe82a6a98abd5c011ba909822455b831720b686
AgentTesla
fbf09b46b7511113432fe9561eeb4294e04799f439d675c1c3a309b739fc2f7b
AgentTesla
+ 355 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230710-rdtxjaba36/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
outlook_office_path
outlook_win_path
Accesses Microsoft Outlook profiles
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
0ebd9fd3f251facf000b74432bc602fcec8d6943d6d0c4ca1dd694ff9fa6008c
MD5 hash:
fdef850a554cdc3d6be75587efb5727a
SHA1 hash:
be0ad5f98deab74da30b4af55ca99d1845d5c40e
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
e340ea47b815c82120bb5ad61d69859657c0aae70483b43de253ce5c24e82eb2
MD5 hash:
02544fdc28fc933b5c3e40f1b73554b0
SHA1 hash:
9e20c599c81ee7a928eb3105dcb2d56d5621fd52
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
3daae544051332ad95fb755c5a16db3e4ffd0ac1c9611776804be2e654bd57af
MD5 hash:
84d36187123bcf70305d41282b772fcd
SHA1 hash:
7b8092b122ffc662dc22e2fd1d983d3991093fd5
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
0ebd9fd3f251facf000b74432bc602fcec8d6943d6d0c4ca1dd694ff9fa6008c
MD5 hash:
fdef850a554cdc3d6be75587efb5727a
SHA1 hash:
be0ad5f98deab74da30b4af55ca99d1845d5c40e
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
e340ea47b815c82120bb5ad61d69859657c0aae70483b43de253ce5c24e82eb2
MD5 hash:
02544fdc28fc933b5c3e40f1b73554b0
SHA1 hash:
9e20c599c81ee7a928eb3105dcb2d56d5621fd52
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
3daae544051332ad95fb755c5a16db3e4ffd0ac1c9611776804be2e654bd57af
MD5 hash:
84d36187123bcf70305d41282b772fcd
SHA1 hash:
7b8092b122ffc662dc22e2fd1d983d3991093fd5
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
0ebd9fd3f251facf000b74432bc602fcec8d6943d6d0c4ca1dd694ff9fa6008c
MD5 hash:
fdef850a554cdc3d6be75587efb5727a
SHA1 hash:
be0ad5f98deab74da30b4af55ca99d1845d5c40e
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
e340ea47b815c82120bb5ad61d69859657c0aae70483b43de253ce5c24e82eb2
MD5 hash:
02544fdc28fc933b5c3e40f1b73554b0
SHA1 hash:
9e20c599c81ee7a928eb3105dcb2d56d5621fd52
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
3daae544051332ad95fb755c5a16db3e4ffd0ac1c9611776804be2e654bd57af
MD5 hash:
84d36187123bcf70305d41282b772fcd
SHA1 hash:
7b8092b122ffc662dc22e2fd1d983d3991093fd5
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
0ebd9fd3f251facf000b74432bc602fcec8d6943d6d0c4ca1dd694ff9fa6008c
MD5 hash:
fdef850a554cdc3d6be75587efb5727a
SHA1 hash:
be0ad5f98deab74da30b4af55ca99d1845d5c40e
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
e340ea47b815c82120bb5ad61d69859657c0aae70483b43de253ce5c24e82eb2
MD5 hash:
02544fdc28fc933b5c3e40f1b73554b0
SHA1 hash:
9e20c599c81ee7a928eb3105dcb2d56d5621fd52
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
3daae544051332ad95fb755c5a16db3e4ffd0ac1c9611776804be2e654bd57af
MD5 hash:
84d36187123bcf70305d41282b772fcd
SHA1 hash:
7b8092b122ffc662dc22e2fd1d983d3991093fd5
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
SH256 hash:
7d96be8384a49ede03c11eaece2a984311fb693507fbbe38d6f9882685e5386a
MD5 hash:
6cdc84b7e74246fa9ad8587f7b9a23e8
SHA1 hash:
ea18ff0d6a5a7ee730bd4f6d2b22215696bffccd
Link:
https://www.unpac.me/results/81857279-9668-4d3b-86db-87e3be3393ec/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7d96be8384a4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/413933/

Comments