MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 824ade3c94d351a00ca7a2ee3d7aa269ad2cb6139f442e3e75558593df3bbcdd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 824ade3c94d351a00ca7a2ee3d7aa269ad2cb6139f442e3e75558593df3bbcdd
SHA3-384 hash: da348a5c57a203288342638a985b5635d210e6b1047095208555f9fb1e7ec84822fabbd9737a2c503c290bffd98c8b8c
SHA1 hash: 7b9d9fd74fc743bdb2954e0877586af8ab9fc77c
MD5 hash: 8eeecc5f246690a4f6c741ff478108ac
humanhash: nineteen-johnny-violet-princess
File name:Curriculum Vitae Adriana Silva.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:594'944 bytes
First seen:2023-04-05 12:10:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'746 x AgentTesla, 19'628 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:nLOZ0u12ncgtP74AN1OibDDT9sOqKfBzbFu9JUOqFC8GFLCxG8:yZ0uGltP74AjOiLTqOFBU6xFBYkG
Threatray 1'847 similar samples on MalwareBazaar
TLSH T1CAC4124B7215DF0AD1594BBBE4A3554243B09532BC51F39AADC838C50FB3F9ACA81DA3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:AgentTesla exe Telegram

Intelligence

File Origin
# of uploads :
1
# of downloads :
246
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ForwardedMessage.eml
Verdict:
Malicious activity
Analysis date:
2023-04-04 20:57:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d57df19d-3bff-476f-9a64-84ad1573c35e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/380282/
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.10051.12933.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/642d6556497fb6f23efd89ae/reports/c051cc54-1740-463c-8d35-12d69f26db10/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/824ade3c94d351a00ca7a2ee3d7aa269ad2cb6139f442e3e75558593df3bbcdd
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/6cfa3824-5194-4d15-a4cb-dfc101f6f304
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1208800
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected Telegram RAT
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/824ade3c94d351a00ca7a2ee3d7aa269ad2cb6139f442e3e75558593df3bbcdd/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-04-04 11:56:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qjfn4peu2ni2adfhulxd26vcngwsznqtt5cc4ptvkwczhxz3xtoq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
048b57705057d98f9cfe2f95f1bc390de79ba3e4abb0c6f0dc131c4adf4bb373
AgentTesla
37af30e0d821d7a867487bcddda594c477b1bf7761f0369011eccaa450874667
AgentTesla
3cacd0691978243f04148ce39e057d9eb18f569515ec32ea49f58b6a11a58313
AgentTesla
b1c86264a08c92aaec1c6cdd9dea602387c0cc2a14d7fd715165a18a757c4ea2
AgentTesla
b8240784dc76e0d06183f6e4518b2a4aa24a7cbe28f275e13ffa35b26d7df343
AgentTesla
bb223547e87ba6c106c9cd0f9d19fc09e17ba8f8c0f02ef9e46b2af80c969239
AgentTesla
d74ab47d8a9609a9a1f341e007629ff6bc9e1f578dab012e86202ee9dc6b1f34
AgentTesla
e92d947e5ba510e9dff65b5e87e56e08df8c70e1bd9a05ea7ed08a860b957295
AgentTesla
ee361abd551977efe8d984071743ee90b31c06573f5b5f954f3aad9284c18552
AgentTesla
+ 1'837 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230405-pck7wsee82/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot6185777927:AAHgIPLnq4XW3y12Thl5pKU-tZT6-UNtnfM/
Unpacked files
SH256 hash:
12be7ba92542445870381836db2d1cee669714615868970ff3759bc6864492ab
MD5 hash:
ba15880d57cb0f17d5df416fc2ca136a
SHA1 hash:
b38e7bcfad4ac45d92509af750f8eecc78aa093f
Link:
https://www.unpac.me/results/55f94141-bffe-4524-9866-00ddc9cb6648/
SH256 hash:
9b9716312d066a025b4d192b141b3e43e3b2bc8f6e41e2de3962e4db42568b1e
MD5 hash:
efe21cf7ab1f4aa40ab41d8c6b25d875
SHA1 hash:
726a4ef71df84475c575847de8ae7ea419a19da8
Link:
https://www.unpac.me/results/55f94141-bffe-4524-9866-00ddc9cb6648/
SH256 hash:
46d612841fd007ea640692ef8be3dde3a2d61c1d59a1c7ff2a378c821e8f91d7
MD5 hash:
b6756078d6580cfdfb11ca322b96b3cc
SHA1 hash:
f43c03804166dd6367a6a3ffe1ec55ea961a1512
Link:
https://www.unpac.me/results/55f94141-bffe-4524-9866-00ddc9cb6648/
SH256 hash:
3c507afadbb1c31a9ebdd24baac5739d47576159e01c5e84f973c951885100aa
MD5 hash:
e79bf0e7e9d52d398e0b23b352394c68
SHA1 hash:
682325763a0ec77e0fd475ea3a4021b4651eceac
Link:
https://www.unpac.me/results/55f94141-bffe-4524-9866-00ddc9cb6648/
SH256 hash:
600246cedeb082c4e032fbb7712997abb68c20f28a9b02a35c9af621cab64d84
MD5 hash:
f4ce4686d60e52a3e354c85e59e9b033
SHA1 hash:
20b7265eb16e38b80233303c6e4a56c3b67c6077
Link:
https://www.unpac.me/results/55f94141-bffe-4524-9866-00ddc9cb6648/
SH256 hash:
824ade3c94d351a00ca7a2ee3d7aa269ad2cb6139f442e3e75558593df3bbcdd
MD5 hash:
8eeecc5f246690a4f6c741ff478108ac
SHA1 hash:
7b9d9fd74fc743bdb2954e0877586af8ab9fc77c
Link:
https://www.unpac.me/results/55f94141-bffe-4524-9866-00ddc9cb6648/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/824ade3c94d3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/824ade3c94d351a00ca7a2ee3d7aa269ad2cb6139f442e3e75558593df3bbcdd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Suspicious_Macro_Presence
Create hunting rule
Author:Mehmet Ali Kerimoglu (CYB3RMX)
Description:This rule detects common malicious/suspicious implementations.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 824ade3c94d351a00ca7a2ee3d7aa269ad2cb6139f442e3e75558593df3bbcdd

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/380282/

Comments