MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b18ae1d0cdc76bff21cb3a55e0e0a9280bd0979bcc049426381f71b2e06d924. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b18ae1d0cdc76bff21cb3a55e0e0a9280bd0979bcc049426381f71b2e06d924
SHA3-384 hash: 88864946262994865df539477da1e7fd34dae8d692f295ea22e9bcd109ab44daa54d3b0aa52b5c420c4e9a54372631d1
SHA1 hash: 479cfd3114958272b579c3d5c1bce522d304ddd3
MD5 hash: ed8096260c9f7de506bac0f750d947cc
humanhash: echo-december-edward-tennessee
File name:FedEx Invoice-XXXXX4210-02032023073135894221.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:914'944 bytes
First seen:2023-03-13 09:39:47 UTC
Last seen:2023-03-13 11:29:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:Jq+O8lpXU5ZkXrWmY0EuOHVFq+gUZBfHtevxcLbtA7h17adDXJg6ot7g2gYnt87/:Jq9mY/uOHDBDPAvxAJ6h17adDcRPtc
Threatray 1'346 similar samples on MalwareBazaar
TLSH T105159E4483484F2CF6E0367D30693EC62E8158DCE9AEBBEF8D67D879B4E845507D6902
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 70f0e6d4cca8f070 (15 x AgentTesla, 6 x SnakeKeylogger, 5 x Loki)
Reporter abuse_ch
Tags:AgentTesla exe FedEx

Intelligence

File Origin
# of uploads :
2
# of downloads :
226
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
FedEx Invoice-XXXXX4210-02032023073135894221.exe
Verdict:
Malicious activity
Analysis date:
2023-03-13 09:47:31 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fb06884b-b052-4322-936d-3d057dc10cdd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/373953/
Detection(s):
SecuriteInfo.com.Trojan.Siggen20.3796.16991.28971.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/640eef7b56d2bc8d80b71e18/reports/cf13d14f-97bd-4916-a6b5-41392515d5df/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/8b18ae1d0cdc76bff21cb3a55e0e0a9280bd0979bcc049426381f71b2e06d924
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/633a9a62-320c-4eaf-861e-f8b7c7e02c09
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1192376
Signature
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 825275 Sample: FedEx_Invoice-XXXXX4210-020... Startdate: 13/03/2023 Architecture: WINDOWS Score: 100 57 Snort IDS alert for network traffic 2->57 59 Multi AV Scanner detection for submitted file 2->59 61 Yara detected AgentTesla 2->61 63 2 other signatures 2->63 6 FedEx_Invoice-XXXXX4210-02032023073135894221.exe 3 2->6         started        10 IfInhwq.exe 3 2->10         started        12 IfInhwq.exe 2 2->12         started        process3 file4 29 FedEx_Invoice-XXXX...73135894221.exe.log, CSV 6->29 dropped 65 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->65 67 May check the online IP address of the machine 6->67 69 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->69 14 FedEx_Invoice-XXXXX4210-02032023073135894221.exe 17 10 6->14         started        71 Multi AV Scanner detection for dropped file 10->71 73 Machine Learning detection for dropped file 10->73 75 Injects a PE file into a foreign processes 10->75 19 IfInhwq.exe 14 7 10->19         started        21 IfInhwq.exe 10->21         started        23 IfInhwq.exe 10->23         started        25 IfInhwq.exe 12->25         started        27 IfInhwq.exe 12->27         started        signatures5 process6 dnsIp7 35 discord.com 162.159.137.232, 443, 49733, 49734 CLOUDFLARENETUS United States 14->35 37 api4.ipify.org 173.231.16.76, 443, 49732, 49737 WEBNXUS United States 14->37 45 2 other IPs or domains 14->45 31 C:\Users\user\AppData\Roaming\...\IfInhwq.exe, PE32 14->31 dropped 33 C:\Users\user\...\IfInhwq.exe:Zone.Identifier, ASCII 14->33 dropped 47 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->47 49 Tries to steal Mail credentials (via file / registry access) 14->49 51 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->51 39 162.159.135.232, 443, 49741 CLOUDFLARENETUS United States 19->39 41 api.ipify.org 19->41 43 api.ipify.org 25->43 53 Tries to harvest and steal browser information (history, passwords, etc) 25->53 55 Installs a global keyboard hook 25->55 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8b18ae1d0cdc76bff21cb3a55e0e0a9280bd0979bcc049426381f71b2e06d924/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-03-13 01:02:34 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rmmk4him3r3l74q4wosv4dqkskal2clzxtaesqtdqh3rwlqg3esa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
29efaf03dee08b4e3f4e23e41b9581513da070dc49e746e91aee2022fef12088
AgentTesla
441db0ba656348d924bb8cd264d09f13cc1f5d1f457ce758aa5baed1ee029fb6
AgentTesla
4b6468989653964cef811f5f54369376c1f07ee33a4d5cb279374a03d0c06a9d
AgentTesla
50e54a9fde90cc5b555710e820516e6a54715ba6633efea4310ba017c113d464
AgentTesla
58173548c2124b6a23d02762e8699b9bb1d8f7fdc2b4365a7c1f97ab8639c1d8
AgentTesla
589459202b13d455eb66686b0ad19c3dcadc8b7b915515fced84ede742868c10
AgentTesla
5f0ac25045091660d4c19a11ef3fa4c75ca597a69bde1ccbee3a99135fcb1832
AgentTesla
aa5336fbd1f094aabf356588943e259fdb8330a19e9e957bf8bbcac9d3ae7401
AgentTesla
b40d1df45c1dba407a1d0e969d076e7278b648f94633c74d10ceee2c3f81f9b7
AgentTesla
f81ea0341cc62ab6c2d730bcfd2d03ec3a970030b028c2083c3e4cb59b2efe9e
AgentTesla
+ 1'336 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230313-lm78mabg4t/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://discord.com/api/webhooks/1081900989902241792/rFoN7jlk0MR9o77RpDTjOrhpsFg6tisJf4nr5Ve5BgdWMpUtC-5sPLHRnlZHzX0I_4Pg
Unpacked files
SH256 hash:
e500556ed0ecaeeb6eb1a7cc0035a22bd847bd62157cb1c28cc60a9cb6bd7f4a
MD5 hash:
d7bc273b689f9b01031c613eb523df42
SHA1 hash:
bee648df9bc95e2aebefc3acf4e673ec2804889c
Link:
https://www.unpac.me/results/1698369a-1c86-4252-85d1-f8b9fd44bd1b/
SH256 hash:
d06df7395d561e198f9b7c5481567116ff2e4c2e84437c018d2a2c8ea6c4ca37
MD5 hash:
0fb6061f7d37424fb9e6d0e76b019c19
SHA1 hash:
98a64bf7b459f032d6ec5793003bf61b5ae1dd74
Link:
https://www.unpac.me/results/1698369a-1c86-4252-85d1-f8b9fd44bd1b/
Parent samples :
495607b1aef01bf7dfb64b5cb16a8fc0f161c2923627d71c69de97328f8eca3f
2434aa78b46a3afc98fa6e888c3eb56278ba52b0ff800e7e875af9c2e7f9011a
SH256 hash:
b40d1df45c1dba407a1d0e969d076e7278b648f94633c74d10ceee2c3f81f9b7
MD5 hash:
16a92911eafba2cb829d29223fc9b0e3
SHA1 hash:
855b6b83d3252e18141bfeeb4f6068607d991489
Link:
https://www.unpac.me/results/1698369a-1c86-4252-85d1-f8b9fd44bd1b/
SH256 hash:
b8a1ad4e40db7cf7c4122f61fdf1789cc94f68334447fc66c53a18fea758a973
MD5 hash:
5bc86f817e7f94ecb3ec0e7d218aff7a
SHA1 hash:
3336232421ab836f7d85e737217fc24046eee59c
Link:
https://www.unpac.me/results/1698369a-1c86-4252-85d1-f8b9fd44bd1b/
SH256 hash:
1c4c5068931bee7097895b848f9f09ebec4a91bf6b1cf8052324f3f375491cd0
MD5 hash:
97e7bdd46f4ac5c541f17a6c968c88e9
SHA1 hash:
1d075738fc10b8c8bd189c9f8d4418ac4d96ea08
Link:
https://www.unpac.me/results/1698369a-1c86-4252-85d1-f8b9fd44bd1b/
SH256 hash:
8b18ae1d0cdc76bff21cb3a55e0e0a9280bd0979bcc049426381f71b2e06d924
MD5 hash:
ed8096260c9f7de506bac0f750d947cc
SHA1 hash:
479cfd3114958272b579c3d5c1bce522d304ddd3
Link:
https://www.unpac.me/results/1698369a-1c86-4252-85d1-f8b9fd44bd1b/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8b18ae1d0cdc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/8b18ae1d0cdc76bff21cb3a55e0e0a9280bd0979bcc049426381f71b2e06d924

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/373953/

Comments