MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88c781e6e6adf31e3e128be59b2d85d3e1f06a21cb7ff657e6484f2d6f9e6559. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88c781e6e6adf31e3e128be59b2d85d3e1f06a21cb7ff657e6484f2d6f9e6559
SHA3-384 hash: 846a91bf8a97e88367af8d934d15974fd472c6acd9e2114576b58341fabf17d0423493fb73ba72e72ff5f0e933765850
SHA1 hash: 5b60c16b85c11298edc82260db00a25f27e4018f
MD5 hash: acfe17878d01e73788528f9c0e36f8ec
humanhash: missouri-ohio-freddie-alabama
File name:draft shipment document.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:593'920 bytes
First seen:2023-05-22 20:33:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'660 x AgentTesla, 19'470 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:dgENqOB1DvSEPYvTsNnJDjNL58B70sKWXqqfRt:JAOHxWTsNJDduTKWXqqfL
Threatray 1'778 similar samples on MalwareBazaar
TLSH T12AC4DF5A61A4CF1BF9758BF19474FF8063F1B073A4E0D1282F6620C6D9AAF101E5CA5B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
267
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
draft shipment document.exe
Verdict:
Malicious activity
Analysis date:
2023-05-22 20:35:24 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/44092959-b453-46ad-b597-d2f612a05ac8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.66809232.28809.2209.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
lolbin packed
Link:
https://www.filescan.io/uploads/646bd1bbcba955e80dac7ef3/reports/cc1ea6f7-8434-471f-ae61-0b5a7bd95b6a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/88c781e6e6adf31e3e128be59b2d85d3e1f06a21cb7ff657e6484f2d6f9e6559
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/06ffc90e-5f2e-4244-9b6f-fe76860b8720
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1240064
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88c781e6e6adf31e3e128be59b2d85d3e1f06a21cb7ff657e6484f2d6f9e6559/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-02 14:50:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
19 of 23 (82.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rddydzxgvxzr4pqsrpszwlmf2pq7a2rbzn77mv7gjbhs2346mvmq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1755a6d6a60e68fa8767edbc6071d2353ef42ca59b0908c0ad55b6b5d8c1289e
AgentTesla
179fdc446f839b4ba88decc73c011758fba7e0852271ec211530f6334776be27
AgentTesla
1a9ae4ba38387ca32e34d86e30811e1cb336ee23400936268f52cf570e623747
AgentTesla
2ca8429adde8868be7eefa5bd9787849700fc642210fe87ee3c72d6ee50c324d
AgentTesla
6056bd2c5f4adeadbafa4e630874fe41cf4cce06d46a7bc68a66e91443d108bf
AgentTesla
74364dacad18ae5d6930c6b8d3c41210ef3d3c2c7899386c2b2c17d7c84142ec
AgentTesla
bc2c9a0032b4118b2d862043c73ebbc2627c31f8fb8afb7bd28b8a27be225800
AgentTesla
bdca02b5a08aacb4702cfabaaca20129ff3c7ff3b332ebaeb41c1b802bb8e19b
AgentTesla
d45f5ad41b7903babda50ffd7511660f1a092699c0ec56ca0dc347fccfe0f208
AgentTesla
eafd56c92c7688c8d00725285da67ada75e227750b9a6f5ecf6d2c0d90e8dc1e
AgentTesla
+ 1'768 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230522-zce1zsdc9x/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
022de27797ad907f38356d85bfba612515f93fdcc357377e918e3c0fa19a82f5
MD5 hash:
e626eed502220e346217a6a67102899c
SHA1 hash:
f022a910ff2b1bc2282c216af70ce7ef826a139f
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/a0030c8b-1a59-4325-8f2a-20a34960be60/
Parent samples :
69dcb21b36f6de65c945422621bc55badbebb0312518bd7f38b704d5a1ae7930
475bd18814dd4181d931894380857accd1428b171ae2f077a6b706411a0005ef
ebe78c5b5c43e135929a0e4d64b63a8707f90e9c1de2fd46ae36d67098d2a559
2736bb21fab5703708ab49c3f24660ff1e8f2fc8745ae19bc422f5e6aff5f5d8
d77497cc30720ab4a1b768d7f20e4e3697fe53c06bd151b6c988ee903e0b6cff
ca5fb8c65adb08fa65191c8c9fd1884cbb730afcff6c9231684bdf6b3a1b6fdd
84652d3181fc4dfad881b733e96b9181c2aa8bf5d3257781228613419f7583a2
72d5d936fa25c900e432099c68cabb79f4637ad70b19913494fd9f0e7534a3fe
a907c4b91d636f9cd26d83b87d50633f1848f9c4c5bb8c5c83b50f0c2dcfaf35
0dd26f6dce309836b816b12516eb74464d844ef234c52e2e0c4bfc46e5ed067f
88c781e6e6adf31e3e128be59b2d85d3e1f06a21cb7ff657e6484f2d6f9e6559
06fbce2c06c6be78142bf529523adc5fa803282dde64baf75861ddfd325dc666
84b007fa05a8254769962daa7fffecfa810cf65414f5c31134ad6b4f6ed0d85c
472336b7af69430e9e8597a1c143d45fb5759d1a58b8055db6cdc862b54c0122
SH256 hash:
21f0154b51a09767f94922b81f5fcd15cf4a6390ab7314e40d0e17b2dcdfe6ba
MD5 hash:
c926563698de3a89ad20474c85122f73
SHA1 hash:
ed1a3b2527ace111e6f39880c7ee3965f301330d
Link:
https://www.unpac.me/results/a0030c8b-1a59-4325-8f2a-20a34960be60/
SH256 hash:
472ebc5a671058ecc72983670939ff5c9bae186bdbc82b0241d8b1e9dc02a018
MD5 hash:
cdc9ccec7d1a863dabe6a27f3288f309
SHA1 hash:
7b635445050d93c5a07fa1a2ddc080db042c8605
Link:
https://www.unpac.me/results/a0030c8b-1a59-4325-8f2a-20a34960be60/
SH256 hash:
8362a107d309eb065d84b5780573c9fd37827ff8f975eaa758b6cec1091172fc
MD5 hash:
c23099f8f63823b69870bfbf7749ecef
SHA1 hash:
2651b69408237d6854e68fc610ea8bb12acae4fd
Link:
https://www.unpac.me/results/a0030c8b-1a59-4325-8f2a-20a34960be60/
SH256 hash:
ca2c20c7218abbf71d6e35c0799f7601d6615990e6c2545dac0fa8ddb3cd523b
MD5 hash:
f204f140541754db103d800ff7646b12
SHA1 hash:
0f82f9195c57f7567a42452bff51be0aaf07f5df
Link:
https://www.unpac.me/results/a0030c8b-1a59-4325-8f2a-20a34960be60/
SH256 hash:
88c781e6e6adf31e3e128be59b2d85d3e1f06a21cb7ff657e6484f2d6f9e6559
MD5 hash:
acfe17878d01e73788528f9c0e36f8ec
SHA1 hash:
5b60c16b85c11298edc82260db00a25f27e4018f
Link:
https://www.unpac.me/results/a0030c8b-1a59-4325-8f2a-20a34960be60/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/88c781e6e6ad/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/88c781e6e6adf31e3e128be59b2d85d3e1f06a21cb7ff657e6484f2d6f9e6559

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:msil_susp_obf_xorstringsnet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments