MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8dac191856d2684130a6b963bc83e538e2ec12ee43481728693419e885f4ae1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8dac191856d2684130a6b963bc83e538e2ec12ee43481728693419e885f4ae1c
SHA3-384 hash: 90bd3b9622c6f1ce65ee2f916561853fc31e22aad3e844bf4787159dd8cd3d36b11702d0c6d60ee97767e41653c7a129
SHA1 hash: abffb2d5286e8133bfbdd671454aabd38b9cccd3
MD5 hash: 915b01e52065ead97fd391de3a466891
humanhash: mississippi-pennsylvania-single-kansas
File name:eFyGWzlTF6vN3FX.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:709'632 bytes
First seen:2024-01-29 13:50:34 UTC
Last seen:2024-01-29 15:25:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:ssTKGZrC0oYjIZXEjAbbz0ZcwW2E73q3sey+uvJeQ/6XHwuQqgdo:H7Af1Aceyr0/XHbMW
Threatray 7 similar samples on MalwareBazaar
TLSH T118E4233E31B81E13C9B806F62422024493F16AA79A52F7C80CE166EF66D77D14F267D7
TrID 56.5% (.EXE) Win64 Executable (generic) (10523/12/4)
11.0% (.ICL) Windows Icons Library (generic) (2059/9)
10.9% (.EXE) OS/2 Executable (generic) (2029/13)
10.7% (.EXE) Generic Win/DOS Executable (2002/3)
10.7% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 1e1a594c6c52124e (17 x AgentTesla, 5 x Formbook, 3 x SnakeKeylogger)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
289
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/473434/
Detection(s):
SecuriteInfo.com.Win64.PWSX-gen.25464.5789.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Creating a file
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/65b7ad59814c2aeb1483ed02/reports/cec0c704-a7c0-4bb7-a809-8d0247085a05/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/8dac191856d2684130a6b963bc83e538e2ec12ee43481728693419e885f4ae1c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/8eea840d-afd7-4485-b429-56fed9e617a5
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1382708
Signature
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8dac191856d2684130a6b963bc83e538e2ec12ee43481728693419e885f4ae1c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8dac191856d2684130a6b963bc83e538e2ec12ee43481728693419e885f4ae1c/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2024-01-29 03:19:44 UTC
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rwwbsgcw2juecmfgxfr3za7fhdroyexoinebokdjgqm6rbpuvyoa._file
Verdict:
unknown
Similar samples:
714f11ed7d83f9cd2067675f873f43e76781fa23982832998d9813738e2e26ab
AgentTesla
8075c639f0c44540b31297187ed884bee21d86549080ae9c3cdedfcbeb2f9e8d
AgentTesla
8dac191856d2684130a6b963bc83e538e2ec12ee43481728693419e885f4ae1c
AgentTesla
ba91cf97e39cae67db5593850f05d7a9fc978b44d7d6a04ee4cc6add8649d4b8
AgentTesla
d4ce99bddbf7352ad97482052b01754e5aca502213aaa3c06242982fd5a42c34
AgentTesla
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240129-q5tkeacfcq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
8dac191856d2684130a6b963bc83e538e2ec12ee43481728693419e885f4ae1c
MD5 hash:
915b01e52065ead97fd391de3a466891
SHA1 hash:
abffb2d5286e8133bfbdd671454aabd38b9cccd3
Link:
https://www.unpac.me/results/194f8a63-214c-4747-a519-e480ebe03132/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8dac191856d2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/473434/

Comments