MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 987a4d7b9be473efd2aa0ff7f0958414d64e0fa058bbaadb702c2024dbc9562c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 987a4d7b9be473efd2aa0ff7f0958414d64e0fa058bbaadb702c2024dbc9562c
SHA3-384 hash: 6a42b14f7544991730eb36344d09dc4eb9c8940825954e2167bfa05c7c98d5588d0535a984946da6d5ad8734c75b7d7b
SHA1 hash: 43465f7653fba854ce4352e3a94b3430826774bb
MD5 hash: ddf58cf7888a97fd914c45aa3c0d968e
humanhash: earth-lake-orange-december
File name:ddf58cf7888a97fd914c45aa3c0d968e.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'222'656 bytes
First seen:2023-06-22 10:35:32 UTC
Last seen:2023-06-22 11:44:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:H7MyuyF18VpjwJ1KNoyGm+wj3LNYJlzlO86R3noJ7BjftcPTeD4L+RZwKJzw:H7MyuyTW0J1KNo/mRbn3JoJFdJzw
Threatray 5'481 similar samples on MalwareBazaar
TLSH T1C645E140325A6F61E47E8BF60921427057F66E6BB43EFA095EC7B2EA15B0F118970F13
TrID 61.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.1% (.SCR) Windows screen saver (13097/50/3)
8.9% (.EXE) Win64 Executable (generic) (10523/12/4)
5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:AgentTesla exe redemed-xyz

Intelligence

File Origin
# of uploads :
2
# of downloads :
256
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
ddf58cf7888a97fd914c45aa3c0d968e.exe
Verdict:
Malicious activity
Analysis date:
2023-06-22 10:40:19 UTC
Tags:
agenttesla
Link:
https://app.any.run/tasks/019eaeff-3364-48b0-b928-6bafae2daa22

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/401652/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.27122.699.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64942413b453925d40733fd0/reports/5b9f1784-f904-49d3-aa7c-dde483d654c3/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/987a4d7b9be473efd2aa0ff7f0958414d64e0fa058bbaadb702c2024dbc9562c
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/603aedc2-f838-4b87-a413-6a9326a98c90
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1259646
Signature
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Performs DNS queries to domains with low reputation
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/987a4d7b9be473efd2aa0ff7f0958414d64e0fa058bbaadb702c2024dbc9562c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-06-22 10:36:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
20
AV detection:
24 of 37 (64.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tb5e26434rz67uvkb737bfmectle4d5alc52vw3qfqqcjw6jkywa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
007391d2d9045b56792ce040d658442ef6bebab5d5c60938c86a5835144a8d26
AgentTesla
1c4c7802f3a6bcc8d0355ad3e5c482c0fcdcb79845733a5ffe5c081ef59241cb
AgentTesla
1dd3caa0895d9aa12c35344464fc9a229b1d55e8d134e83362fe75753f36ae74
AgentTesla
331bf1b8daecf2013f1a87e15ef1e185a1fe02958c31d22bfb0ddc499d69a80c
AgentTesla
3625699aceef8218cece58914659f6ba003e6f26ad033645ed738b4972050aa5
AgentTesla
85c5b8ce343047febb9f3313f1cde4e1a37dec4a776addf9d4d6db10758c290b
AgentTesla
8d47a0875bae9f6a20e36525e6be0c0450e7492fb540a1f65802601bf8e558bb
AgentTesla
9d3b203f9301ae7c6943e12c62db105761ea10f6b6a0fb3993805c50b4a345e6
AgentTesla
a5cb5ed5237d5e446dd4c461b4673283bbe2339d513300f19920c1a86a45f6b0
AgentTesla
dc091920175bd059d2925977e1806df9930c40db5292a73158bac390fca03d75
AgentTesla
+ 5'471 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230622-mm81ladh65/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/694a70bd-366b-41b1-b3ba-622804c3a5b1/
SH256 hash:
7f172c992a432859bfc19589ebc3e26a05d44beef3e9baa55e29a3932e885f8f
MD5 hash:
714f9d4bb0c4c023e2c4e1aa6077b500
SHA1 hash:
c9a71d53b57e4b751a1d6864e0b9dd1bb1bba1f9
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/694a70bd-366b-41b1-b3ba-622804c3a5b1/
Parent samples :
007391d2d9045b56792ce040d658442ef6bebab5d5c60938c86a5835144a8d26
987a4d7b9be473efd2aa0ff7f0958414d64e0fa058bbaadb702c2024dbc9562c
e57c444a50a0cb9ac14152220923763532f8a280c37ff45ee55ef28844740434
4b40e11d7fcbf9eb1f49889af19bc26a8c3ef6faaf2c8614919d1ee0ef8f2ff1
SH256 hash:
0160739cfd8d1897931f6821d701e3089c2bbd03d3ff8ed977ca4c618876b7e4
MD5 hash:
42fa7553572a0e8d2056a7c77597f57a
SHA1 hash:
c1beb634d03f733eedf2f2b4fc3ab14a4b388ae6
Link:
https://www.unpac.me/results/694a70bd-366b-41b1-b3ba-622804c3a5b1/
SH256 hash:
85e74d86dcf3df8d07e4a7530bac5f1718980eae06a142f2d501c85f1eba90ef
MD5 hash:
6fec46a00d6e2eda0abcfd06338a9d57
SHA1 hash:
68f07319524a667243a4a2d82fb900a883071922
Link:
https://www.unpac.me/results/694a70bd-366b-41b1-b3ba-622804c3a5b1/
SH256 hash:
7aa252e3258f7fb46271de1e26744eeb0f983dc185fc87136e719253218273b8
MD5 hash:
e4e1f97c4da855f378afc20968fc0dc0
SHA1 hash:
5f59911787226c02f6e209cbd311f56e99f20d2a
Link:
https://www.unpac.me/results/694a70bd-366b-41b1-b3ba-622804c3a5b1/
SH256 hash:
987a4d7b9be473efd2aa0ff7f0958414d64e0fa058bbaadb702c2024dbc9562c
MD5 hash:
ddf58cf7888a97fd914c45aa3c0d968e
SHA1 hash:
43465f7653fba854ce4352e3a94b3430826774bb
Link:
https://www.unpac.me/results/694a70bd-366b-41b1-b3ba-622804c3a5b1/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/987a4d7b9be4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/987a4d7b9be473efd2aa0ff7f0958414d64e0fa058bbaadb702c2024dbc9562c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 987a4d7b9be473efd2aa0ff7f0958414d64e0fa058bbaadb702c2024dbc9562c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2638384/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/401652/

Comments