MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85f7d296de25155108c48bafa42ddcba37feb9add3f20c3b5c65ac321ec9a70d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	85f7d296de25155108c48bafa42ddcba37feb9add3f20c3b5c65ac321ec9a70d
SHA3-384 hash:	f7c0d0835aec8d74247b0524a50a3afaf2d91ab62153c6bfe1d5b91cd2efad7046fd5642c9a9f02c83a8ade7473c42c7
SHA1 hash:	1c3847617eb8f75553128d2cdfa372d531646ba1
MD5 hash:	42173297d6593b53dcccba761d84c210
humanhash:	michigan-april-snake-ten
File name:	products.exe
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	616'448 bytes
First seen:	2023-05-15 05:39:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'207 x SnakeKeylogger)
ssdeep	12288:xo1M+mQZ5Vy0X0rNe6d94AqdylEy8WmrlhNHEYvR7mJzRSGOv65WzKj:Ka+m0H0rtrGocVhNHEY0JBOIV
Threatray	3'507 similar samples on MalwareBazaar
TLSH	T1DFD4CE49623BBDD3D62806F1610038924B3DE11678F8F4FC6D9BB4C9C8DAB914BD52A7
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	threatcat_ch
Tags:	AgentTesla exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

274

Origin country :

CH

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

products.exe

Verdict:

Malicious activity

Analysis date:

2023-05-15 05:42:32 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f81b953c-77cb-4f15-be08-d919220166dc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox XorStringsNET

Detection:

XorStringsNET

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/389925/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.66992851.32350.18678.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Launching a process

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

86%

Tags:

formbook packed

Link:

https://www.filescan.io/uploads/6461c71d2c920903b49271ee/reports/09576f51-bbff-40f8-b7a7-1ef24e417a4a/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/85f7d296de25155108c48bafa42ddcba37feb9add3f20c3b5c65ac321ec9a70d

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Agent Tesla

Malware family:

Agent Tesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c1ca505b-2901-46e3-9309-0e4f63395c6c

Joe Sandbox AgentTesla, zgRAT

Result

Threat name:

AgentTesla, zgRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1233379

Signature

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected zgRAT

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/85f7d296de25155108c48bafa42ddcba37feb9add3f20c3b5c65ac321ec9a70d/

ReversingLabs TitaniumCloud Win32.Trojan.AgentTesla

Threat name:

Win32.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-11 08:55:47 UTC

File Type:

PE (.Net Exe)

Extracted files:

9

AV detection:

21 of 37 (56.76%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qx35ffw6eukvccgerox2ilo4xi375onn2pzayo24mwwdehwju4gq._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

09a4c4066f68ea3dd5f0ca48f85fb76064c4f0bab39ccddf4b8590461d2fa9a0

AgentTesla

256206be49f97b60b3e580901f31d726e194cfcf0b50a291cf67f7a6267aeb18

AgentTesla

2824923e53f00d95246e6af0ebdf392983d4afb436c1c4af2a5420a41a827ecb

AgentTesla

3678eacb8a54a9b0112aae9c691b5ddbbe86631d17689abd544a1acac76c1ce8

AgentTesla

42fac947ed7be43e589d194a49aef65b306055ad3d42ee3b7c9a2b03cda99cd0

AgentTesla

5b58f94841a17d6f347c5d32f4ac2e2fb6d7e4954d65b5138ed7fb44c924c3a0

AgentTesla

6c5deef73d02f6a72b9e5db340f3a5e3743d6a63fe0827815378bf2b13624d39

AgentTesla

7225fb26ac598e2675891df1f0733d038fcf691e7e04c190f700813132cd5040

AgentTesla

ce951f9946a66af4cf461317865d760231a083710a35ae4d2ff362201ec66966

AgentTesla

d5b4018736e8ded7a665f2051a05e9fdd53e379eceee4c62abff955dbb5e4554

AgentTesla

+ 3'497 additional samples on MalwareBazaar

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230515-gcvsbshb9w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AgentTesla

UnpacMe AgentTeslaXorStringsNet

Unpacked files

SH256 hash:

1cb0143fb91c98fa790059bbc2c889948029944cd9e7ae62efd0a83264031780

MD5 hash:

673d1515db6ad29a4634984e68085489

SHA1 hash:

be694bc3d654a20c873c8cc5f6ca6458c75c561f

Detections:

AgentTeslaXorStringsNet

Alert

Create hunting rule

Link:

https://www.unpac.me/results/cb14bcfd-8764-4bdf-a74d-714d46feb79c/

Parent samples :

7225fb26ac598e2675891df1f0733d038fcf691e7e04c190f700813132cd5040
256206be49f97b60b3e580901f31d726e194cfcf0b50a291cf67f7a6267aeb18
3caa5f70e285a2f721a9d8d16dbcdc56a5a9cc85463fca195baea784840f1650
2824923e53f00d95246e6af0ebdf392983d4afb436c1c4af2a5420a41a827ecb
42fac947ed7be43e589d194a49aef65b306055ad3d42ee3b7c9a2b03cda99cd0
ce951f9946a66af4cf461317865d760231a083710a35ae4d2ff362201ec66966
85f7d296de25155108c48bafa42ddcba37feb9add3f20c3b5c65ac321ec9a70d

SH256 hash:

5790f02b04be740d87ff63898101cd8d22c4ccfc18fa96016f629330a173c712

MD5 hash:

a390e61e5f2490ec4abd56a454652c8d

SHA1 hash:

a0d0547249f485bf1d0a14736a366c5e0e8548e2

Link:

https://www.unpac.me/results/cb14bcfd-8764-4bdf-a74d-714d46feb79c/

SH256 hash:

c72ca892abebd8794a9544913d071c3c91356f5075509717727e180e87cb98ba

MD5 hash:

25383385b11436b817ed4dc0419f4e24

SHA1 hash:

9441f35f45a30503ebb2c717209f29341b5b48b6

Link:

https://www.unpac.me/results/cb14bcfd-8764-4bdf-a74d-714d46feb79c/

SH256 hash:

42ff51f4dc572c178c94a7c1764376f996d6d89652cb2f0b2c9766f45ef277d0

MD5 hash:

4f5648af5b9f103c960ed3701195961f

SHA1 hash:

6a2754de310941cb78872f5565eca618468b1ad4

Link:

https://www.unpac.me/results/cb14bcfd-8764-4bdf-a74d-714d46feb79c/

SH256 hash:

715f3abb174f6119cb662a0635f2704fa877d6e2b29ed7628e90267c4c620943

MD5 hash:

6732d493c16c2b7064e48d7aca6e0181

SHA1 hash:

0e5444bb510ab8087314848f25665669584dbee3

Link:

https://www.unpac.me/results/cb14bcfd-8764-4bdf-a74d-714d46feb79c/

SH256 hash:

85f7d296de25155108c48bafa42ddcba37feb9add3f20c3b5c65ac321ec9a70d

MD5 hash:

42173297d6593b53dcccba761d84c210

SHA1 hash:

1c3847617eb8f75553128d2cdfa372d531646ba1

Link:

https://www.unpac.me/results/cb14bcfd-8764-4bdf-a74d-714d46feb79c/

VMRay AgentTesla

Malware family:

AgentTesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/85f7d296de25/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.61

Link:

https://yomi.yoroi.company/submissions/85f7d296de25155108c48bafa42ddcba37feb9add3f20c3b5c65ac321ec9a70d

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

exe 85f7d296de25155108c48bafa42ddcba37feb9add3f20c3b5c65ac321ec9a70d

(this sample)

  

Dropped by

agenttesla

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/389925/