MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 867f65eceabe8913a49b397bc8c874dc42b6b76608cd5fe0e2c9b3ac2f165bd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	867f65eceabe8913a49b397bc8c874dc42b6b76608cd5fe0e2c9b3ac2f165bd4
SHA3-384 hash:	7081356b084f597ef15e0ec2016d8524212ff530b88a223ea54eef5959422ec3c2a071f3c97b0246af0643a36d5a0db2
SHA1 hash:	6f1119fb4b7b7dbc621c6f4ce2aaaf333a97e236
MD5 hash:	effe206578237d6f5a8f00f4a67db4cc
humanhash:	sad-stream-hotel-mango
File name:	NEW PO.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	728'576 bytes
First seen:	2021-07-07 05:03:48 UTC
Last seen:	2021-08-03 10:35:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:Ar4puKf9c9yg9L+pgBmboBeYX73aGEr6nPUPyii0pELWQf0KBj2Lp6Ig1026h:64pNf9EyqQcEYr326PUPN
Threatray	6'404 similar samples on MalwareBazaar
TLSH	66F45A983312719EF426C872B957DCF0EA107E664A0B820350D33F9BB91F5D6CF951AA
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

206

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

NEW PO.exe

Verdict:

Suspicious activity

Analysis date:

2021-07-07 05:10:12 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/d2bcc171-b8ee-4b13-8861-6c08c629abe5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/170096/

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.20554.12441.UNOFFICIAL

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/453dac35-1575-4abd-af3a-ecc9305a1d82

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/812679

Signature

Allocates memory in foreign processes

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/867f65eceabe8913a49b397bc8c874dc42b6b76608cd5fe0e2c9b3ac2f165bd4/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-07-07 02:14:31 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

15 of 46 (32.61%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qz7wl3hkx2erhje3hf54rsdu3rblnn3gbdgv7yhczgz2ylywlpka._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

4168cb7280d51dff7f076d035d5233f5008af3ea643b8ceb89ccb9db1f9b601b

AgentTesla

49c52b95a4e8fb4790b5549c90a4f2bb7895693b1054d82074d66ca8fc5f8162

AgentTesla

4f332e317c5116e7c9b64ea8084a39aa4fff859a056ce9463557bdb0093eab55

AgentTesla

88f94c1e8a555d84bf7ad2e0fe21d82d33f1976786267af93808cc050d039bd9

AgentTesla

905a69a36fb36ef3a1def54f23b03ce216458d2966fe623af8e7430f079a5681

AgentTesla

b1db9b45aa4903a5d9086d759765f4cb76a23e601c7bfd8133d440cace108307

AgentTesla

c050a7941b34bdcaf777425c5e17c279f7c9e92414cfbef866974bb4ea216fe8

AgentTesla

c8aa28f1143bf3cfbaa0a067109896538cbbfb5eac08f922bf287d12c7f2948a

AgentTesla

f077eba249e41b618f2beca6307585844eada56f528de4fa2468dce43a81fbda

AgentTesla

+ 6'394 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/210707-c3fnj9cr9n/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

AgentTesla Payload

AgentTesla

Unpacked files

SH256 hash:

44f66cb3304ff50adaa5d08a17cc84b4ff15eab6490c5eb3ccbdc3fd33e7dc3e

MD5 hash:

d00d7c0b63fcdcd4f5e7fd0560b703ce

SHA1 hash:

92cf7d349238d8e1904eb93ca12052b0814a6f38

Link:

https://www.unpac.me/results/000fb8fb-5094-48a0-a847-b46e2ba39ed1/

SH256 hash:

d1d2749ff0dab6bb263ea0e98a9ba9c0ea0c1187f99926a96446d0da023a2571

MD5 hash:

8e48f627032f06547f304b2671629421

SHA1 hash:

8cbc21f04af3fd2001052b6957184075767f5723

Link:

https://www.unpac.me/results/000fb8fb-5094-48a0-a847-b46e2ba39ed1/

SH256 hash:

5bede9eedf6ae6df5a9d587c116c9583b31474c159c2b53486b000093cb3fde6

MD5 hash:

072eeac61b35d3f09edee4ff4f80f52d

SHA1 hash:

696fd9905a47e526470c2e234fef32f1ec1b74ad

Link:

https://www.unpac.me/results/000fb8fb-5094-48a0-a847-b46e2ba39ed1/

SH256 hash:

867f65eceabe8913a49b397bc8c874dc42b6b76608cd5fe0e2c9b3ac2f165bd4

MD5 hash:

effe206578237d6f5a8f00f4a67db4cc

SHA1 hash:

6f1119fb4b7b7dbc621c6f4ce2aaaf333a97e236

Link:

https://www.unpac.me/results/000fb8fb-5094-48a0-a847-b46e2ba39ed1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/867f65eceabe8913a49b397bc8c874dc42b6b76608cd5fe0e2c9b3ac2f165bd4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.