MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7
SHA3-384 hash: 9a6f1d9b7cd283339e614acad396ef6fff19455465a41b998874f268d81109b65d7c69e222a286949c2cb2125a2cfd39
SHA1 hash: cb2d5518291bd2ccc9f5a29b98a5b597ed55edad
MD5 hash: e2e5fec0590ace89b05dbf61eb2440ab
humanhash: east-quiet-lion-carolina
File name:SecuriteInfo.com.Win32.PWSX-gen.6879.24262
Download: download sample
Signature AgentTesla
Create hunting rule
File size:646'144 bytes
First seen:2023-09-22 03:31:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:brD60A+C9m5SdaCKXH1AHjCcz7lG45edvghw9dnNU0KK:XDv5SjKXuuyG6aJrBK
Threatray 105 similar samples on MalwareBazaar
TLSH T1FED4236E66E84E18E83E07BD263253F09BF7950A8824DB4C1CC365992E1F380F675D97
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0070e0c4c4e07000 (9 x AgentTesla, 2 x Loki, 1 x Formbook)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
339
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.6879.24262
Verdict:
Suspicious activity
Analysis date:
2023-09-22 09:12:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ec80a9cd-be06-4b5b-9f07-9a67388b4240

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/450537/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.6879.24262.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/650d0ab233582f234eff20a3/reports/6fe6471f-902f-492c-98d9-74252bb42895/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/35bfcfab-f590-4104-af34-295671519e92
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1312721
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7/
Threat name:
ByteCode-MSIL.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2023-09-22 03:32:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
9 of 22 (40.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r6jzuf5xztstpbfrcgwqddmtegi6peyfwwxbfe2hka5shdzcot3q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
0cc4308eaf906783b45db5c75d2bf7e5a0b74d9d531dcce595604c1f436d4fb4
AgentTesla
4588c6ac02ddd81f8315af2307ec516f58400c555ecd74944a77964fbdd992c1
AgentTesla
5aff1db8f4c749933cd8869e1e80f000e4c27de7c0c7a7d1aa59c4f324522210
AgentTesla
6eeeec436d7abca44202ca9e5f3e20d2bc6a7f4adaf240e1ba5ab41e94890c29
AgentTesla
8ee018d985fc1492a623c99ffdcd39c768a0cdeb975d791ebd3a1c372ff2128a
AgentTesla
9cfa472702dbedc0f87b0e594d3c8ace16e1c9952d8d7e44be8aa9114b214c45
AgentTesla
b842e2fd60338a5a60a60ca5e4ec84be149b7a15c7840e93c2e22ac03843701a
AgentTesla
c1d19cee2a05f48cedd6f1f7aa6eec9e27c00cedb7135d0187200b030b302c6d
AgentTesla
+ 95 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230922-d3l2bsee45/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
043961098da7adb01104bfe078e0a9ba8ef1581c08c182bda7dbe321f9a2cbe8
MD5 hash:
70898a3cb1089c9bfead550b36b55d88
SHA1 hash:
9deebc8dad032b8c062744e0cc7f211d390c7c5d
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/681ce33b-1738-48f3-833d-36f9ad0cedce/
Parent samples :
5aff1db8f4c749933cd8869e1e80f000e4c27de7c0c7a7d1aa59c4f324522210
6eeeec436d7abca44202ca9e5f3e20d2bc6a7f4adaf240e1ba5ab41e94890c29
8ee018d985fc1492a623c99ffdcd39c768a0cdeb975d791ebd3a1c372ff2128a
8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7
afbcc4589635ef9e83579c9865d99e7b454f827e5ae02b8248db0fc73d9553c4
SH256 hash:
eb3c14db4a7fe19d173136aed70921e64e0f45381a556f0f87ecb0f4f9ce8a8e
MD5 hash:
f95951ec1268bf89deb167d4ad8074c8
SHA1 hash:
f63707eea9536bddd0abb93683342b53c1e850a4
Link:
https://www.unpac.me/results/681ce33b-1738-48f3-833d-36f9ad0cedce/
SH256 hash:
1ab75cfa6837fc18a36ad5504cafb225ee23d6177bac1d2163703c74747df9e4
MD5 hash:
d6dde7209e7fc8b775ac0fbb1ba24967
SHA1 hash:
c7580a23b99c7584acf00cec07cd422327ad990e
Link:
https://www.unpac.me/results/681ce33b-1738-48f3-833d-36f9ad0cedce/
SH256 hash:
d4d5678b670977ae70f3797f601836b21e98bbbc875de0509943abd243c046c3
MD5 hash:
d39bd0c2eafcdca7ec6d692631d52ae0
SHA1 hash:
c0f1f6d03116044e3ca7ff8f5425f14b7dd0ac8c
Link:
https://www.unpac.me/results/681ce33b-1738-48f3-833d-36f9ad0cedce/
SH256 hash:
8a9ad1e2541ee24511e3b5a6395b8a52f01fa724ac09d98dca5f14997be4c563
MD5 hash:
6ef5453c3ddf60975099e168ef5aeca5
SHA1 hash:
b3eab40460fe6dc976bc0283c1de0db20a45f615
Link:
https://www.unpac.me/results/681ce33b-1738-48f3-833d-36f9ad0cedce/
SH256 hash:
95304209bc061dd56167b9ed7ee600a563494c9162b405dcff4a39d50e70e0a5
MD5 hash:
167aeeca1245d0148052c3c6bd7798bc
SHA1 hash:
a162be58a2f904dc9a403e5ed22c782035cea80a
Link:
https://www.unpac.me/results/681ce33b-1738-48f3-833d-36f9ad0cedce/
SH256 hash:
8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7
MD5 hash:
e2e5fec0590ace89b05dbf61eb2440ab
SHA1 hash:
cb2d5518291bd2ccc9f5a29b98a5b597ed55edad
Link:
https://www.unpac.me/results/681ce33b-1738-48f3-833d-36f9ad0cedce/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/450537/

Comments