MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9005c9522aa361a5fdc143f907b8fced088d2a92297fa7c32a510048a063f5ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9005c9522aa361a5fdc143f907b8fced088d2a92297fa7c32a510048a063f5ba
SHA3-384 hash: c3f9775c061a3c2b6dbe95ddf01fce65d044501f9b207f70aef2b522d851a6a987027688b45cf0d39202e8aead7c33b1
SHA1 hash: f572f5b0f8f35dcd5590357193c4e2a863be3b18
MD5 hash: 8cc5d514f1d2ba1d4a7eec602d861f15
humanhash: fifteen-cola-avocado-salami
File name:RH2G0009000000.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:634'368 bytes
First seen:2023-11-01 06:26:35 UTC
Last seen:2023-11-01 08:16:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:6HcQgJKcwMpr3lGTAipzdCRh/Vm3FQ+nUGmpHgWLlykINcwAFj:6HcQdQEM0rnZmpHplykINcwq
Threatray 295 similar samples on MalwareBazaar
TLSH T13AD4CF0072794F16E67E87F5A4B0140083F9367E753EE3495DC261DF2AB2B108AABB57
TrID 61.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.1% (.SCR) Windows screen saver (13097/50/3)
8.9% (.EXE) Win64 Executable (generic) (10523/12/4)
5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon d2e8ecb2b2a2b282 (106 x AgentTesla, 106 x Formbook, 24 x RedLineStealer)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
302
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
RH2G0009000000.exe
Verdict:
Malicious activity
Analysis date:
2023-11-01 08:24:59 UTC
Tags:
agenttesla stealer
Link:
https://app.any.run/tasks/63112d03-d0a3-454f-8151-21067be1b262

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/457508/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.16376.4940.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Unauthorized injection to a recently created process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6541efbe390b22a61e5465a2/reports/e5318d1f-e83d-4424-bb3f-49689a3c9a2b/overview
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/9005c9522aa361a5fdc143f907b8fced088d2a92297fa7c32a510048a063f5ba
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4ec8f305-1f8d-44b6-b62a-393c68432fcb
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
spre.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1335237
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Contains functionality to log keystrokes (.Net Source)
Drops PE files to the startup folder
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sample uses string decryption to hide its real strings
Sigma detected: Copy file to startup via Powershell
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1335237 Sample: RH2G0009000000.exe Startdate: 01/11/2023 Architecture: WINDOWS Score: 100 32 Multi AV Scanner detection for domain / URL 2->32 34 Found malware configuration 2->34 36 Malicious sample detected (through community Yara rule) 2->36 38 9 other signatures 2->38 7 RH2G0009000000.exe 2 2->7         started        10 I$s#$lT3ssl.exe 2 2->10         started        process3 signatures4 40 Bypasses PowerShell execution policy 7->40 12 powershell.exe 13 7->12         started        16 WerFault.exe 22 16 7->16         started        18 RH2G0009000000.exe 7->18         started        20 powershell.exe 11 10->20         started        22 WerFault.exe 21 10->22         started        24 I$s#$lT3ssl.exe 10->24         started        process5 file6 30 C:\Users\user\AppData\...\I$s#$lT3ssl.exe, PE32 12->30 dropped 42 Drops PE files to the startup folder 12->42 44 Powershell drops PE file 12->44 26 conhost.exe 12->26         started        28 conhost.exe 20->28         started        signatures7 process8
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9005c9522aa361a5fdc143f907b8fced088d2a92297fa7c32a510048a063f5ba
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9005c9522aa361a5fdc143f907b8fced088d2a92297fa7c32a510048a063f5ba/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-09-05 01:02:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
18 of 24 (75.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sac4surkunq2l7obip4qpoh45uei2kusff72pqzkkeaeridd6w5a._file
Verdict:
malicious
Similar samples:
266e0c476f1988732a361461a4837386b72f215f5135033512c12bb3dde329c6
AgentTesla
3ec765c9bb4306f79f0a66c06fbed0327a19c71ad4e2088ba920b09269966c72
AgentTesla
7e5e3c49e0bcb2e16b86e870f591feca75b0d7007ed5851ecdfb70fa3d06976c
AgentTesla
8bc2d2a8e99fdf12dabed46d100d94d357e064f307718087591e9858c840a1c3
AgentTesla
be97e1d540ea8ba81adbd8873a4ef6123f6d5d3ff51fa010e432ae7e4cad8e99
AgentTesla
f7b800601e3b238161684a6921827dbed9d3f285740028da7f59e42968fa96cc
AgentTesla
+ 285 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/231101-g7rzxsdg49/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
b39991e0cf1630a6fb51e58475485017cb871bca1a115835abf895df24f18dde
MD5 hash:
fa4f67bc731fc3c41fb6d2609a7ddd76
SHA1 hash:
a7b387ac011f0ac1a6ce602c9bc30d89d487f09d
Link:
https://www.unpac.me/results/5815f719-8def-4c4e-8ec4-0a5d9c037dcd/
SH256 hash:
94bab96726bcd097fc6d5a5093f523159dbe1a3c1b46c4a121f2555369086cca
MD5 hash:
3fa549edfd1450f9cd47bf6e7f7050af
SHA1 hash:
8d66fa7205b13cc7fa867b74983e65dbfc3d444a
Link:
https://www.unpac.me/results/5815f719-8def-4c4e-8ec4-0a5d9c037dcd/
SH256 hash:
02bc30e85b3ddd86181ca0604f7f22266a1bd05f6cc83a7160781431f98d6171
MD5 hash:
b0014aef90ab2f6947fed832c36aa3cd
SHA1 hash:
7623ff18f7922cdf86acb095e47cdc99a88ba7f4
Detections:
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/5815f719-8def-4c4e-8ec4-0a5d9c037dcd/
SH256 hash:
9005c9522aa361a5fdc143f907b8fced088d2a92297fa7c32a510048a063f5ba
MD5 hash:
8cc5d514f1d2ba1d4a7eec602d861f15
SHA1 hash:
f572f5b0f8f35dcd5590357193c4e2a863be3b18
Link:
https://www.unpac.me/results/5815f719-8def-4c4e-8ec4-0a5d9c037dcd/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9005c9522aa3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9005c9522aa361a5fdc143f907b8fced088d2a92297fa7c32a510048a063f5ba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 9005c9522aa361a5fdc143f907b8fced088d2a92297fa7c32a510048a063f5ba

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/457508/

Comments