MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8678f9a3ecfd06cd0f5f2ecd34414ccfd0dc475b8f7d4269e330b5935a8e8f99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	8678f9a3ecfd06cd0f5f2ecd34414ccfd0dc475b8f7d4269e330b5935a8e8f99
SHA3-384 hash:	4827a1f860719066051fd7c0a44b250e3deeb54b880b9cd3b43c13888a14f04eb8843152a6cae592afb62f3303863068
SHA1 hash:	38ed03b4208f14033f1876d79c2802c1edb72dcd
MD5 hash:	68a6b3ebce37c9acf86a924e7c98ef73
humanhash:	low-finch-sixteen-earth
File name:	SecuriteInfo.com.Win64.TrojanX-gen.27636.18626
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	643'584 bytes
First seen:	2023-08-01 15:29:09 UTC
Last seen:	2023-08-02 06:49:56 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	12288:EpiRSej8BonVvRyaPuzrfMChwVEv44jZVMri5OVp9fw0z41MUNhHHKm7PH2:EpiR3wyVv4aW8yyE53OVLwugMEHKg/2
Threatray	31 similar samples on MalwareBazaar
TLSH	T1EDD41244F2BAD51CF8C72E73832D52029CD9DDB7609CAA02DB9ACD36DD450B05A9AF70
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	SecuriteInfoCom
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

291

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Win64.TrojanX-gen.27636.18626

Verdict:

Malicious activity

Analysis date:

2023-08-01 15:29:46 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/1c869c14-7c6d-43df-80d3-56d94ee2db79

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/439637/

Detection(s):

SecuriteInfo.com.Win64.TrojanX-gen.27636.18626.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

DNS request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed packed

Link:

https://www.filescan.io/uploads/64c924fd2e037e88653f9950/reports/b32c6081-f050-4741-a38f-e76f2a96f2c1/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/8678f9a3ecfd06cd0f5f2ecd34414ccfd0dc475b8f7d4269e330b5935a8e8f99

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/e67b9c18-02f5-4705-8791-56f40045c8e6

Result

Threat name:

AgentTesla, Neshta

Detection:

malicious

Classification:

spre.troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1283842

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Costura Assembly Loader

Yara detected Neshta

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8678f9a3ecfd06cd0f5f2ecd34414ccfd0dc475b8f7d4269e330b5935a8e8f99/

Threat name:

ByteCode-MSIL.Trojan.LummaStealer

Status:

Malicious

First seen:

2023-08-01 13:28:42 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

22 of 38 (57.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qz4pti7m7udm2d27f3gtiqkmz7inyr23r56ue2pdgc2zgwuor6mq._file

Verdict:

malicious

AgentTesla

1705bafd8562bc925e54c571066a069538863a6581a86f6aa14f76245fc3af78

AgentTesla

4c673b59e43c4475cd1204bba60adcef91be7bd9116d5548102eca86f6b0ffdc

AgentTesla

4cb622e428772576bdcf156ec4030b782f0764fd6ea9da4de543e5723fb62b9d

AgentTesla

66585a437c7394893afc35afe6c80a9cc7f21427adff7610a4c50a69d26fdd58

AgentTesla

6a3ea5ef986f8bc290a7393c4a890e87b583f5d30d2afa771b3540a54ae0313e

AgentTesla

73f2bda2748d084de9a966db5a390504cc5bd65f030492ac50861d2587b49e7f

AgentTesla

d5dff38d0773eefad7e6b3fe7005e8ace7c37fc9a6b88eca21f6120d2b860f32

AgentTesla

+ 21 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/230801-sxglzsha25/

Behaviour

Suspicious use of AdjustPrivilegeToken

Unpacked files

SH256 hash:

8678f9a3ecfd06cd0f5f2ecd34414ccfd0dc475b8f7d4269e330b5935a8e8f99

MD5 hash:

68a6b3ebce37c9acf86a924e7c98ef73

SHA1 hash:

38ed03b4208f14033f1876d79c2802c1edb72dcd

Link:

https://www.unpac.me/results/f0262fea-9d93-46d6-87fc-faf0d836e6e1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8678f9a3ecfd06cd0f5f2ecd34414ccfd0dc475b8f7d4269e330b5935a8e8f99

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.