MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 851cadfb7b72af94db5c9db85e0d52dfcbf3fa948c7498627e4b67162cff6e7d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 17

Intelligence 17 IOCs YARA 19 File information Comments

SHA256 hash:	851cadfb7b72af94db5c9db85e0d52dfcbf3fa948c7498627e4b67162cff6e7d
SHA3-384 hash:	28e8c5706f9af014510599c05efff6221d9bb5c77fa4660a010f7771a597d1adc09daf175f1d68a305584a2ed7b315b2
SHA1 hash:	209d2263e1baff1943533effa0f3e1964d98b8cd
MD5 hash:	e984689ddc606e421d3cf8746ac0783e
humanhash:	yellow-london-glucose-mars
File name:	851cadfb7b72af94db5c9db85e0d52dfcbf3fa948c7498627e4b67162cff6e7d
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'120'256 bytes
First seen:	2025-01-10 14:31:56 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	24576:CPIeeUQE6/PCxEF3IKBteMUvV5554HvPtht:2Bey63uERxBghV2PX
TLSH	T18035BF583A95E80FC35289354DF1FE7996384EA96E0A93039AD33DDFBA3CF895D40181
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
File icon (PE):
dhash icon	0cacc0c4b0944c10 (53 x Formbook, 1 x AgentTesla)
Reporter	adrian__luca
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

151

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

851cadfb7b72af94db5c9db85e0d52dfcbf3fa948c7498627e4b67162cff6e7d

Verdict:

Malicious activity

Analysis date:

2024-12-04 01:16:03 UTC

Tags:

evasion exfiltration smtp stealer agenttesla

Link:

https://app.any.run/tasks/75b8d1a4-3bcb-4e6e-8908-1704d870dc4c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Packed.Ratx-10038422-0

Win.Packed.Ratx-10038456-0

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67812fab1e9cdec7dbbb7556

Tags:

agenttesla lien

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Reading critical registry keys

Connection attempt to an infection source

Stealing user critical data

Query of malicious DNS domain

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/67812f8fcf3f467cfb42afb4/reports/de14cdc2-c125-4ee4-9d85-810a4af13136/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/851cadfb7b72af94db5c9db85e0d52dfcbf3fa948c7498627e4b67162cff6e7d

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a04ab134-d1e1-46e2-9a9f-fd9b75913650

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1588700

Signature

AI detected suspicious sample

Found malware configuration

Installs a global keyboard hook

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/851cadfb7b72af94db5c9db85e0d52dfcbf3fa948c7498627e4b67162cff6e7d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/851cadfb7b72af94db5c9db85e0d52dfcbf3fa948c7498627e4b67162cff6e7d/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2024-12-03 16:28:32 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 38 (63.16%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=quok3633okxzjw24tw4f4dks37f7h6uurr2jqyt6jntrmlh7nz6q._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250110-rwdchayqhn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Agenttesla family

Verdict:

Malicious

Tags:

external_ip_lookup Win.Packed.Ratx-10038422-0

YARA:

n/a

Link:

https://app.threat.zone/submission/ff32153e-0e32-4b94-b4b4-3e0bc2f87ea2

Unpacked files

SH256 hash:

bbc2e44d3556706693ff54f32038e0113a4dcc31f6982c1f5e23fcbc612a4b1d

MD5 hash:

4bed8db5ac048ddafc6f1681cc79a454

SHA1 hash:

cf9c9c996b95fc856423ec7a1e4099615b34ef0f

Detections:

AgentTesla

win_agent_tesla_g2

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Link:

https://www.unpac.me/results/b8724cc7-fa2e-4f97-b90b-d603ce0d1563/

Parent samples :

4d1527ce09d716a68f0a548a3fab80d2223028460e036f43b579f211b91b0ff3
523d949366cc9f4ddfa2d9c261bf1f0741879b32cc821e6e654830184ff4815b
a7ba3de84abf4628a7b7096e7f28b4d8b6946429d6f8b1e8f0b5bd05eba3db0e
6d4a4773e58d272f90abdde88661ce929741814276e20ea43384114f6e6cbbe9
46c5226221c4a2c2a2d46eb2ea34889f2ea736f3ac91bfe800efba0ef277973e
fdf4c8ee3fc626020998a24d5969fd5a30ddd46f64494fe0e74ecd26ca579f5c
35a9609805bde63b4e22255d365fc6a61724fcb9f8456899bb085b76f0160d5d
82903347dce74dade6fe581fa776ac312af0bdf508c42b66a36c09ea439c1bbd
f03acdb2a846f8060d76c3d81651949b5699a5dee5b2b26ec238872defd12252
75fdc92b3101bba09f964b73e7931a7b021442e130e64dcc421d155fa50806b7
bbc2e44d3556706693ff54f32038e0113a4dcc31f6982c1f5e23fcbc612a4b1d
851cadfb7b72af94db5c9db85e0d52dfcbf3fa948c7498627e4b67162cff6e7d

SH256 hash:

ee93e306c22a9846a60019b69d372bbd690c43c011124d31febb6698a7deb7b8

MD5 hash:

dec16c1e3faf3dc6faf0debbeb198a2b

SHA1 hash:

6621c80692dc5b0df16e37ba266dfc945c9aa5ba

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/b8724cc7-fa2e-4f97-b90b-d603ce0d1563/

SH256 hash:

acf09c80699691d3a6a8d52577d06a7054c1bda1953a55527251e92e15ba037f

MD5 hash:

69473b5123488cff4aae599aa14eb3a4

SHA1 hash:

1d3562fd2fb55582cb97441b9f01065dd80373fc

Link:

https://www.unpac.me/results/b8724cc7-fa2e-4f97-b90b-d603ce0d1563/

SH256 hash:

851cadfb7b72af94db5c9db85e0d52dfcbf3fa948c7498627e4b67162cff6e7d

MD5 hash:

e984689ddc606e421d3cf8746ac0783e

SHA1 hash:

209d2263e1baff1943533effa0f3e1964d98b8cd

Link:

https://www.unpac.me/results/b8724cc7-fa2e-4f97-b90b-d603ce0d1563/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/851cadfb7b72af94db5c9db85e0d52dfcbf3fa948c7498627e4b67162cff6e7d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	AgentTeslaV5 Create hunting rule
Author:	ClaudioWayne
Description:	AgentTeslaV5 infostealer payload

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Windows_Generic_Threat_9f4a80b2 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample