MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b83d463c4ddfc873ac4954f326d473cd6aa3443617fdba8860680188500def6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b83d463c4ddfc873ac4954f326d473cd6aa3443617fdba8860680188500def6
SHA3-384 hash: 7e059152f9e6db249c4af437d9bc7c4a45fdb6797c749b13bcbdb9acabf2e9fe0ae0a3fc4e88d2dfc3b1fd5f2776038c
SHA1 hash: bc1ac337c76c8bd07143511204b1d01a46415ca0
MD5 hash: cdfd6bd119864ccf2c5ff262fa6b9e5d
humanhash: texas-ack-iowa-quebec
File name:8b83d463c4ddfc873ac4954f326d473cd6aa3443617fdba8860680188500def6
Download: download sample
Signature AgentTesla
Create hunting rule
File size:955'392 bytes
First seen:2025-07-07 14:42:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:xvYzGASYfVsFlEIU+N8FddvhRX2FvOD+SdEISC4fHg9WRJPCzl:xqOpxN8F+vu+SdEPfHg8
Threatray 3'407 similar samples on MalwareBazaar
TLSH T13415CF0472B48F4AE47A57F90126C67093F65E5D74BDE7098DEABCEB3960B012A84F13
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon f0e8ccb2d4d4f0f0 (7 x Formbook, 3 x AgentTesla, 2 x MassLogger)
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
26
Origin country :
HU HU
Vendor Threat Intelligence
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/13007/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686bdcedc9eb974737677034
Tags:
virus micro lien msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending a custom TCP request
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/8b83d463c4ddfc873ac4954f326d473cd6aa3443617fdba8860680188500def6
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a5d5ecbb-ad5c-40d1-95cf-125eb0f1bf69
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8b83d463c4ddfc873ac4954f326d473cd6aa3443617fdba8860680188500def6
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8b83d463c4ddfc873ac4954f326d473cd6aa3443617fdba8860680188500def6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-06-23 02:24:48 UTC
File Type:
PE (.Net Exe)
Extracted files:
56
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rob5iy6e3x6ioowesvhte3khhtlkuncdmf75xkega2abrbia333a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
a3bbb335406677c373dc6f68ce37705ef3e419439378ef2b58f93302914e0e3b
AgentTesla
dfb8ecbf4f52efbf20605c2be946d62bb062edf1dce896a9b45516c7aa90e422
AgentTesla
f82f264ad6f058381f88f1a6a98315553ac229454e95d2da4260dc897c953016
AgentTesla
f9c3b78cce61d4ef1c118287edc5d5d3324bd64df1d2c704c087e7b073d7eb33
AgentTesla
+ 3'397 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/250707-r26k8stkv3/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
AgentTesla
Agenttesla family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/84a914a4-ebec-4035-aeb8-accc7c339a3c
Unpacked files
SH256 hash:
8b83d463c4ddfc873ac4954f326d473cd6aa3443617fdba8860680188500def6
MD5 hash:
cdfd6bd119864ccf2c5ff262fa6b9e5d
SHA1 hash:
bc1ac337c76c8bd07143511204b1d01a46415ca0
Link:
https://www.unpac.me/results/9b4f2c92-3e35-4596-8bd0-6adfafd179a2/
SH256 hash:
fa3889846854ef037c9e350a7274d50fae8c2ff11e91ce1e06453cd351967119
MD5 hash:
9d7041814acba87c294b1abcfadea481
SHA1 hash:
53bc6f748ae5c851d23b6ab8635d38fb9eeaf58c
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/9b4f2c92-3e35-4596-8bd0-6adfafd179a2/
Parent samples :
a6cc6e17a43fd18e44449df2bee44d53d4098817149e1d443a61777cf458611f
d6a676ac2fedead7999ed8250543e38da6096cc6efd3c7517d49d6b090ffbec2
1fca7f3155e24ba3e96508a8b406395c80966cc7aa5f0ff9e6201f7979c80b8b
dfb8ecbf4f52efbf20605c2be946d62bb062edf1dce896a9b45516c7aa90e422
797f44aa209382a598bf62263d36a65d3c0b238c6e056ac1df84dd989d79ff03
7d6248b79e83e710efc263a60b855854648088ea196e3460aece7f3fef4dbc8c
841a3a3d4807c215f922e72b1391e8c56db813173a248ce4e5e7b29b5534b5ec
b1f950d68fb3e445f741d2bb7fefbcfe1b1a756548dcc6f88b173cae77495b57
0195c54fa21dd3d6ba8e59245bfe3953c0b56a05f53f877654a634a5bf088a86
fe8abf598767162b0eb16dcf51205afcfd221eb2b2f23f32e5b286de19561df8
0c7252f921ef57eac052095ee10c5553c98f123d2f7484d795179c19689df5d6
f8e5a47c68fac52c69ec3fd461cde2ff76d64fda08c528c066a0ab822485cd23
5abfe96f31b8b8e4013501cbd3e7bb332e03b37e96f04cb75f05c04f15bb66ac
e09c5d8ea6eb4b7eac7c73e951e3e43d95a62a94fa053fdb4ef64da70fd76361
04a80cbfdbc1428ea6a1b6377bdd9d164163abf0ac1460e59db8862cdc322382
4cd5676a9e5f1f59e10c246d9a6c674518e66031fea5e17d23318ece2c5e9c67
ff14655342e9f2d6c62955f89111bded7e4d1f65237201e502fb9b7fbd75c46b
4a6dcfe4dfe7d02d44962cb9e47d87d6d755d0a9481a8013b145eb674ba567a0
a25bab1b3a0b9ff47c05a477831e3c14ba6b3b9b60a1a7d339595b8c5243313a
cdf8c43cdca0aae5ebae3ae4155f8ec78d84eec31e864c0cc843b99c61d36c1d
20331b45b686e183cb628218e6fe464eb1e7e2f56ea9336e7dd3ec067d194226
4fb637c4caacb8d3ea6a9db3b0d06cc8a9b5b0f23429dab7d0697053a55aa0dc
a497dbe34f12783111bc413a4447e581e48e5c539f8325ce95fc71800f1e4c43
e89363fb758ac1d01dffca3212cd980aa3fe199efda522052fc8c3e041b31f70
de9c905c7d05ee8775d644ecc9354ca87a1c74fe5eb23537c0bec8784e7dfaaa
b456078d0dff3c375378480fb133a340d88ae4b59d6598ead4249d66523f3428
4bc3ba71f56e14ee1e7eb8f6fea0fbda1a9aa92545205097476853d0308ad623
f47b7f935ea1bfb7dab5c9e31e368aeb7a07fe506a4cf430c36b9a3cbe8ddcc3
d24f280b413e7e170bdc29ba7bfaa7a3d221e582204c331803a9fbba64ff7d13
bb6f0186eec1d2587ecd2b6b0e0c88c8189823fc633c56848365b362dc3f53de
44bcdcc19976200147601f72c903a84f73d79a82782af77a5e4da96b791fce73
3144e19689bfa00782be4602c85cb949b03262fc1da9c2ea1e765258668b61ba
e5d18d2a845b927f1f7d7f7e33031a20a3d6b540e2b00f3c064255ab3948e7f0
c8b76fc09a283dae6e7ed2f6cae8e31d0b4038abf3f851da15672110b99fd23e
698e5418168e5500b644766ea8c31cfc826ec6399c1f61cf85481caa3c183a65
638c6eea32c710305fe44d62be21b6ab68a957e8a07a487b2501d82bb2419f1e
e61db8e0b03e566917d24767e2146e6335f4dacfd1b1a8cda8a49de6e0544a19
f700199315360a824ed6eca65f543d531d04210118e3cfc8bfbe986ed1641aaa
0f421725abfeb6485909289412de00d17fafa7f2f13b4f6e439f9aaf637c2470
cc5401e45d7f9f7e2ed916b1ecf9acef960d221e4512ba7f465bde7b56b57834
fae7e35584a2df9dffeab985c2b6128609a35ff7eb7d994b6295e8a3bb5817ed
f9c3b78cce61d4ef1c118287edc5d5d3324bd64df1d2c704c087e7b073d7eb33
0ca32ef99b452e03e0a45dc234399bc6a8588ed4eabdce7afacce73f3c20aaa6
ffc12a905f90d00b9381e8e3226adaf6c25e3deabab70580a46f39eb1e68deef
a0a646a7539bcf09db1f8d40395bf5b5c1ae885e808e512bbb4b898a4495c079
87fb77ed68ec8001ca8f1dcd4be4bba3dea657778223ced143964dfac2239f52
090be2d28dbb7a3d5782f1946ca17e5c048987dd027090cf1de7b8cffc0c07ea
0f99bf966f34d5152ee51fd8510a37b3fc0792334c9b8f2475e896bc2ec72a6e
89a08615e8a94f42744b85d9486cefafd9defa24951b8d69f0c8aadb082f2487
1cdb6733c402bb21c71997839d008b94e69097f3156e69bad3dd7c252cf042e7
97719ce27cd8169ca0f4db352c3f9c53fd700c55d059e9835fbd451e75f59bb6
da00184567031f30767dae698ef809f2faa6ce271b03a4e03695f0b236e68d1d
e4b8f8770eb2fe1a6aefd4ac5087a04e1034bb5ab320a200b8d4e3279f835597
9247f2f45db631dd50e32455deecd8bc32a05cea40bfcb4c3f3b9ebb0732eafd
19d152d22b4b9d39d05e579b9fe7c48060ad4f2c2786da3dd3d497197ec3c7ad
bace7360ffdfb5ba55798cf7c08452ea943877d49de2f135956ff0eb0e0da98c
0228c928cdc2312658629a75d65bb333014b28585f6b5614db51b86e7189a234
90c39e2981ae3de1f04f0e946d0c50271e718cd853eed6333e67964c78a25465
d29651c63ccaf0392b12fe7d501cf7072878a1d5bdf77cd98d9ce7c53c98d907
2f835a2d633b2fb81fb9375cefc17313e59a283de5869b7d7f04b42e9134cf25
0e6389a3fdfa62ca6e1b852be32912ccc7152011c3de3bb12bcca515109b3f38
e82761150effc8a77c096328b3fe325dd7910104f9d756a56868653e3c813dc6
56dd5e30024791d0240babaf7110454704ecaa0936bdde1c7a3e626b89a6c7cb
26d88548fb6387644d90e615eca6e1f0103ffc5df0b4de341c81cbdc28d53ce1
bdf389c57bb92746de7ea48eff0df48bbb66bccc9e451e632b7ed76398ab7e0b
3f41083e15aa4dc793017ee919805df5132743988a31cca59099d5a8842f4186
a04a0223a2cb079868f34225df1953d8897690ef0fd730f2d83a8dfa9515d874
3a8d95ebd1a116107405f1cb2a7d42e954643a9a0244ceef22a70b656b8525a3
6fa16359905843e294d5f805986bda12aa603775ea7db1eaf10beff3493c3b93
1494ed37c7ea409a0d8445032855474030fc4dbe0c16844b3b349d55acea5de8
f6445ad9735732aa3ae46b05eeb7707cca1aa4e0fa4ad72e64de3d1c467d5121
bf166be918695404ec2724b62671d7eac13fd67e39433894439d70a2ce534861
a3bbb335406677c373dc6f68ce37705ef3e419439378ef2b58f93302914e0e3b
7e855c3d24b8bdd605c526a0d007d88b90c76c9b9b1ae837d48db2c987f75765
93e14efc8eadf9f9dd7d4aae3b8d680e22ad771d94caa155cd2ee774b3712a3a
8be521d630b1c7285e4e2074443ba82175636714302b975bd27da3e0cb6fc270
6924363cb427ecd59994781e876040d4f0f2422fec9b0e1f61dbe9000dee2baa
5f192f10cc75f3be973d6f3725fb0479f70f67fbb3412f9900a272730acf17b3
1d9b47e8366507c23d81a11dfbc4f5e54c95f6a4b778da0c5990feb28751bdae
5f16ee8e5457480d3780ec03b7b37d9a43f0621a4e8bc0bea6fe77695f6e1ea3
0f546fee6a66dd05082402fcf23e426d2b5bd8a97f6544b77ad951e1f65689bd
7412c73049ad87dbfc8106ce0fc8a03ca2a21d6507fcdb53d96fb2efb8ac1561
4ff0882b1dfe25c7b1793da9754485d1f1a28e660934e8fec5b7aad2e5571502
8f503c7fdf82f233c787200e9672d93ff653affadc78fd3549a477650f4aec36
ff67a4429b3cd257a8ef58dbbc90450eda82271ef4256ba1dc5fa6eb215fedec
86c422aeea528f860b82e8af539b3d38f4c06b1f574addcc0afb200972c51473
140e2bbb3ae25648d8993155ca60f6dac9369dc41ad2eb4fa87cf6104ab938e0
e4408864dff2496aee90aaad03699d107a62e047c19da2f396c3e4a5e1e18692
d20f814c949d8aaefbb38fd7fc5a3d51358e209c88bb40ed611ab34802e3fd9b
9cd9d15f66f824f3df89cb5fd98a32e768a31dd3e0d05245d15759be6b88129f
2f0ae3872ddb72b9c17060aa7608559a5cd92d376dfc88441ff8c54e6f1a65dc
b9634112c7c3ee5da40fdc31fb9a1f4c05dc0c432945575f869d3566c74c4c0b
a14bc89b9c0e1ef9160cc2dbd223eda8627b4919d616a2668e93f9dea8334246
033c55f8f206bede32c03f77eede842650727506dfad0be0aea118b79f9dd922
068035d7c009e6fec1d2baaad409c8289f1c1bba84c1ba792efe5f963db3f97e
b310dcdd9e68c3f72ef76ef1f10506a3094e1de2f96564276d0f7dc8d11bf5f1
8038e254a1dfdbe9a67358318bbe1f90f935b97d9eb6d87717101ff93224884a
e4c4cd20f12ca28fcf603d531dfb0dd6cd0e0222d5187d0e7227d33854776050
6efe9fbfc3d3e47786a8ae76434966a1c64f7c4e91d8709c4eb36ae7b6bb0a86
e2263780bc74e9300528646a608133f1b123def3ceb62d09c5086f32ae813e82
10ef58d9ab1de0c837b94cf2c65618936c9ec98c476f9b262e0c33c0fd752112
2ba48ba616ce16bf1a7b6d8dfbb09f1c984a4c27b11d12b26531992dd4373f23
7c3204c01bd91defa73bf48c8537104084583572061a3f81081aec3275741535
b974f6e408fee02342f4cc5fbc1580da54c4fbbdb3c7541f8cd0cc7aeb097df7
9e3ec9a0a7c86125bceea9ddc46cc00ad70476b0182da370ee8358fcf543939c
ef31e67b0e3fde58acd72fd5e0c6939b82935df5e683e94042239f834d6a2936
5e6b39d039f9fc05c0262c84b33cdfe703b70df0be1491cb2afa294d344756fd
62bd1a4886eaea5b5bbd21eea90540913b0a7a573305b0eb7c58cc61e93ecea0
76c83209bd8b50457ba60e433a6a49be1f03471d506906ee18b8b211fd0779dd
27da76240b4d9ff64b74ed54b40950861096cb90098a81262051704b63aa9096
a0f8fddf5306250fb6d1a880798c989ba07fe83ce09c8aa82c7c968d840ad243
372210f4c6442c3236ed1b7dde082f60d169afc634d13e6953a86230e4fc06d2
88d0ec8c33ccb203a5312e45ae8674fd2f555de075e9a1fbbab1905bed51c1d9
e3ab15a37eb0ac7fc858be0a57d6ca34de07545ec156cab774114a031c72ab4e
a86e9373657effff617182f3bccd52a5e6013e635ca40357d468871f38fdaa8b
7d5e8db5ceb4205a26d726a6375394528dd1ccb55084f337ac69cdd3b0bff6ae
3b6585b5a221372d1ea06544e7762ee242a7790c0f6dccd4905b48af00b45558
d496059f895bbd1ec2bb25f7f4c0395210d085bc525b013c2fe3d962d5e76a48
95d237db17e891b78afc8df935075fa973a0823158a6b706be8695f8525775b3
74ca5aad35d138c31e8cc8bf3a0d3389ab321fac99483f475fa434a6ffd8a6a4
82dbec85d38c90b698f12ae23f185b3f5a76b15b0f544530ddb9750c8fb80d6f
a6ab3643364fe7f07cdde83e146d477a37ed88618cb0278cb5d030ca3f226759
767aa72294b73ffbe525ee35fccfd5939a9cf6d1128717ac159ee9b9f9adc759
8ed52e5cadcf8bc30a3e25bb135c0d5e4e81c8fd43ee2843736bc614998e9a34
8dfdf9c7b2657d5f27838a2ee023e77497bc31e87853983974db402852a28ebc
9a80aacb95033e97acd1faeb405e0bf54e3e891cc8963244c2036ff63630ea10
888e3ee78f9d77ebe995ee5cd3aaaf1b0c6f1c62e5349fb2666cc8ca8c095c7e
2ba41f387ea8d91674878017056d8653151a1c2bc45b4d4c4d97c83657b01db6
34df432fffd0dff5f4a974f12dd75d405816892e113100f34ed1b3bac7358ffe
3361b8e7bb64b56a082e777887264cc89d4694640bc53e1f44f86efed13e2108
d592e061c641ef816a8dc1a6d83d36578a84df47f3b063c06299c8debc4b8a21
be09dbae32fa67700c6ebefff7f8e081b61efd7431cc7326093703a172f91530
bce8d98eb5c366ef1c2bfe0d513e1e59230162943f5fae377a3f1cdb767fe3f6
90fc5b8abe7025184179b0ecce4948baed241898ae625f3710ccc1cd92bcdc00
49ca026d8d0b9af34ff8daeca673475a84d249fba5c6a8204b8f9a15c0145820
451202f7640bc0ba50330e90b7d4496707f2bedbd851cc8be2a7a38dc91ebc1c
2032e1262f598729cad41b1ada73fbbbcec199ee877c825583650c65a824210b
9c6a17b9f0909eb2b0feebbf337d3bd8d543a7e8c9344242382bf814b6fb614d
e70d76f8e2e25aac085a95feb18cbb6283da2ca8b7b65d383723cceb84eff706
38a4d9f237a7a43c30064b9013215249ba0245abeb39428eadb28d120a7e0087
d0d7734635bf2c12c9a6c714ac512d11ef03e4f00a3ecd19cc666653436c652f
8b83d463c4ddfc873ac4954f326d473cd6aa3443617fdba8860680188500def6
1d8b3cef330d50251ae4a59b3cc24e341cc38fffb03f3ea0731ceade94ab71d2
69b4c8361199937a0cb7e28c689e3dfa2967af5dc5ed0c1fccd770273cc3c71a
2037288b15790f8046e536194e8e2cd78f1cec0af33e2368436368475b2c37f2
5430d9faf55e36dfc17034194780f1abbad5f5670f63ac3c1870da3352e2f342
ec7615c1c9aa8d049dd4c8f86407d3253b30137a88e711eccd2e26e017dee00f
7f44edb791af09f8161a6b292d6fc82cf3601e56e1996228133081914a660d50
84f2e7778e3a25f2b9900ddfdfce6bbc39a6814f791c44100fd7d35d38dd95af
0f9f93ac54a96bbbd431fde1eb4bc5499e94286e8234f396d64d0b5e6f5394e2
5902a20f794b3c5ed37a3d76eeaa2f4a8be1548d83f9a94026986813ac5ddaed
1431c6a53d3d523daf93f328d21e164db1457b7499b0db9da818325bea6cd277
de95c7fdb27d4768c98e3ab9230019ae3ab2f2d54890778c839e6f7be10e2bee
567961fe8882128ade4c226651ee188e05fdd8927daacea3ca1a2c487d049dba
890a5d662df8f575eb47d331395eacb582e888494ebea7edd10a9374b605b937
a97ce603c002e36fe4dacfa2df5f77756b7fa2e827c934152ba1acbbdcd6675e
3fa202fb6f5dbcfd3faa63fea105e530440204fd747ba386b9a290545453d4d8
57fd4666f5ee7b31e8b02f6c31d0a33bb08f5eb1694a759b0b1aa95ec9fc0524
df71af12f27e4f7512bc1ce4b7765e550b30a1887fef2e0781770c2c840d262e
22bfdf4ec2732b1eeb75d671dfb2b417f64242b9f30e366c1207cff835a3e175
6abd3a82fe2451100cf201fe9669462ba805b4ce1e754cfb779083592b24bcc1
3f992a10ab5d213b5cad26ba4f416c1e5c54b386d1c20c8a2f4ccd20c5b40e24
fd9203e74edff64b5059ed50dc2bab90592a5bff46a84efd9a7c2f3735509952
e8792948e135a95560f471d83d37df68f63452ac67f33b643e7a1ecea4f04c6a
b24151a525eefa5dcd9b083bc51b383ee8fd51c8b5dd59ab6743b39209196dfb
1c237d4ca5bed7db9150b849ea06db16f44218003ac9649e412746bf6af9ab4a
8a3c4a4dedc8ccc8dcd27b9bb2b0f2a3982b938cf9185c0c4c5b8a46a8321002
47c1e1964a4887a5cbdbe07724152dce1fc0d4f1a81466fb7349a02a8c0de8b8
2954300a43acc2d8c0fa950282160984746ac1d5a7606be99e2c87d03dfec961
SH256 hash:
2bfde305793352cc0da1adb8ed99447ad59f25f03c67d5756905cce802618749
MD5 hash:
90cebe77febe3d68f79fb7e03876149d
SHA1 hash:
a665a04102d72778358e1b045fe3dd46996d2fca
Detections:
win_agent_tesla_g2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
Agenttesla_type2
Create hunting rule
Link:
https://www.unpac.me/results/9b4f2c92-3e35-4596-8bd0-6adfafd179a2/
Parent samples :
bbe3fb7e0f0ddf898c7f5055707dcd5847cf14801f02563f384b75ffd06ece4b
8647436d5b5e93de1fbaf9571e584ceaee4a620cd39b60472da87e694239c317
c09cba9da1f8a6c8fbda87ce1c29455118eb13876286388a7d768ba98585aa78
d9af97e029e98b7502110beee9913df5132c5e1ad620e6b8124bd395c72131d9
fcb4c6602aeea8229338eab9ed2deb97c27e07601791ef19c7e43a830079e416
053c940f835b1c6624b6b0421b680da5c984b056734db107a7d6c8dfbe1837fd
8e3db35284b6e1ea560c14a69ea4dfd6ef8e27fe9974a609116d00f2d764bfeb
c9f0c595e62ee31b17e1b62cc7be551a1cd46c3395a282fead293a5033674328
793683a76efa38f5ad0608e7a7419af3802b4a7cd5d3d428f2f1a7e6f0e6ad0e
db20bf3295f1aae23ce386ffb850622a77a474a8a1ddaf240965082ee03055bf
faf287257529efa93234ce96fd47d0d43a4884deb7ec54e337bb8ba49b1d12d8
90bca1aee1c83d0c4efc1d89a1c57b991be078a6fcff421495fb9cdbed974c70
b3339675855dc36ef85d78208f43924b6eb62a978caa41971115b13a8c9cd951
03438d007dd69f9021f8c37eb21cd9f817189c99f86e94136b0f6223e07a7366
20aa510e22a6e0abf81a9cdb4491977cc7035ef0f62bf4e97e880688594707a8
ff487e2ea6195cc78c6c3f1d9d23aae0902eec37964143cf85cd425252a0072b
eec4404be651d77865707efa282ec7899a97550ad25351a70a926679f6b34bdf
430ca931fb30ead2352f1f6cc4c832d5e83d0586818e47febd3d9d2dd83950de
e0e7d67763efac156e039e3b9b8e4cf0e269109164788c4901f338f1399699ee
a2e0b264504e6338c455b6227e85273903c8f1f901809eeaaaec9e917ffb09dc
5565d238feb8a0e52f4185f696eac6e4d817d878ca99aab4ab16a341b3c828ed
7a52724e8dd312054edb1fe92f4661be8a4696efe209edfec3f43b7fb8fac3c8
97a1e4bfc76eeec8faa59bd7de85088d2e42cf9562ea66c2305d0309080712ac
68f8a928d8c7b9b1da3ed341ad581da0fadd5bdddf781e0d8831c94553d8d5b3
10eed1464345d7548cbbe6e76ece440f249d9daf5bf13f973f68136d986c7fe5
99e2fcc17330e0e1d8e31c814d659c4a00110a6da389102e22a25eedae3933b2
cb9c62c96c1409b6151ec4cdcda1b0750a13dd61352ca9ed91382a978cc8bba0
7f7219150a44e397a72f82fe9c4232887e991f0b3f0469c29d5cd2b8e3f3d0a7
1f73dccfdf8ee9cb8fb841e40c88a7b124cd28c0b06688eaf2bb81ef4f4ac0aa
c75134c43e97b75bca4ced11b721253c5774cb0a78184acdc5c55580aa07df85
ad3517d5640b93e40bc1e839f6616222801d06dd83ed5887462a71f3858f5b40
941559a78b6e1caf39212048e7f62723e5f283d1942858cc07a339d6d6b24362
59e8919a70ecf74746e7bac52469b520a8a4fa929e8fa8171e22342d8dc4e1d6
b3c12cee79f27bba7b9d58c690083d38170fac66c70ab18dd5897bf0268fc114
e9be7f50bd810d3b8a459a54c2310b567dd7065cb52803306cc5e6132eb9e12f
2b1c8e28590c81630fe3c284857734161139c1998cdd28e899cd1049bf5fff0d
20b88c89c50d71a77a0f2e1007a39cdb0b78f44c8507d3b492e8875a44861279
25cc6ca776e3d36b9aa29c331b522f23f1b309398372089d51297ff179a51bb6
853b91e9b020663d17ecc679445126b293adf51dab2791e846c31adf4fbb232a
2f7226f97fc49d8e893e80ff5e3e1127d0ae76650045dbf30c36ddd0535c0af1
8c511dab54355d76edfda60811e62b832f7593919b5c8f683b53bf6690bc808b
2ed7941c78a8b93373502b3b638392b1981785718e31bbbcca4f251d6b21f535
fb98e235d9cd58d96ab4d3389fdacfff82beda19357f313fabd95729bc984ee1
2fc60266d45774d861a84e932cb572f683a5c140406a6709adb10a08e5391b9b
2843e5be520970bc04d4c2d1d64749c730cd115037cd11b10a5c4073f001ad7a
ea245dfb5adebf5c9635d41f7e92c9194f6a20f900d9bcb14b8931501f0bd411
4da351698b0432b56b06b8bdd26fb7103b973a7c70bf666cc1a26e13fd2585bb
29d5ec780d5e5c02484ba41f291e35d29910e0ea2221c48f2ba19c9be746b8a7
602c89f6771cab55f5ec65aeaff614585d4cde2ff38f5751ca52fd062e871d19
0e52d5414536fce593aada88c26086af95af6b44d700b70315f4fdd9feb0b093
b21d51c3a5519c6e41de9ef4e4bbdb821f2d76f6cc1e2b01d0a0fae37723f25b
f687ef7cfbf2fefbfb85644f57319e28c04f9feed590a317056fef8c130c092f
d16be68a77facd56c4553aff3be893308c986f726619cd0785b5cf8cd5993f88
2c94e0937726b8c53f46350c17b50abb816f720708055e92a097c796a9970f01
265047bb3b17c31db8680e5dc97255cfc147e02f730db48a6852cf403033ea69
933e3e0bf29c5545bb4ea400f0ad62be69b957475e82a6bc8ce3c2a44622d4b0
71e061da69a80307913e97800c500938e1aa6eadde0fd25758b9b394ed1532e9
ff67a4429b3cd257a8ef58dbbc90450eda82271ef4256ba1dc5fa6eb215fedec
2f0ae3872ddb72b9c17060aa7608559a5cd92d376dfc88441ff8c54e6f1a65dc
9bb11533ca7287474f25da8cd5ad24afacc6b66175798298c6924035b9b3f92d
ee0176357d58650cedb8212e95249b9ac0e17145587e398a344c03ad95334618
4c17a091bd4bc5abea728c7245ec9c15fb98693e661bc6ec20239b91db33faa8
8024fb977a8ce280bd9bbe8984c2a1eb02a39c82222940de7b8951fc1493cd80
8b83d463c4ddfc873ac4954f326d473cd6aa3443617fdba8860680188500def6
69b4c8361199937a0cb7e28c689e3dfa2967af5dc5ed0c1fccd770273cc3c71a
0f22c8a761d26fc6db2f20b2c3070269bf8248eebc03743250da0805ee9a8511
183c72638416f3649f30da841ff7a88d29f6cf22f393db7a96407e939b9c6647
SH256 hash:
71749c1964164bd2ffa960994d18490a9795b20cf5af9e5043b0699ba9c1d019
MD5 hash:
aa372467076f15c061ebd603d2b7504d
SHA1 hash:
f9fa7a93e30e772968154f8088e26d197d72f7da
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/9b4f2c92-3e35-4596-8bd0-6adfafd179a2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8b83d463c4ddfc873ac4954f326d473cd6aa3443617fdba8860680188500def6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:agentesla
Create hunting rule
Author:Michelle Khalil
Description:This rule detects unpacked agenttesla malware samples.
Rule name:AgentTeslaV2
Create hunting rule
Author:ditekshen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:AgentTeslaV5
Create hunting rule
Author:ClaudioWayne
Description:AgentTeslaV5 infostealer payload
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Windows vault credential objects. Observed in infostealers
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:MALWARE_Win_AgentTeslaV2
Create hunting rule
Author:ditekSHen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Generic_Threat_808f680e
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_AgentTesla_ebf431a8
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/13007/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments