MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9897c1f7d4ecf7e68ba31bef6c909543d69c6bbd95a17d061f45ed13f4b92bfd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 17

Intelligence 17 IOCs YARA 7 File information Comments

SHA256 hash:	9897c1f7d4ecf7e68ba31bef6c909543d69c6bbd95a17d061f45ed13f4b92bfd
SHA3-384 hash:	dd096dc1442a90434a185de3f41317b7ecee8594828443a1f02a9b034e653d60bf5be74dff936e9fe39c82b8713e3fab
SHA1 hash:	4265826ce0e9c88336c44334289c570df5b37309
MD5 hash:	ae89ade9f160589390e9c250484ca6b2
humanhash:	bacon-winner-stairway-enemy
File name:	DHL documentos_97866542353647589676846545635434535678908886765354657869780876954.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	778'248 bytes
First seen:	2024-06-02 13:25:30 UTC
Last seen:	2024-06-02 14:23:57 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:qgOXNuRchFVU7XkZP4ADL2bi7IXo1vzggznbNOc6VBvcX0N/pF3vvkEmkR:K1VU7mPr2buIY1vMgz0c6TcX0N/T/vkk
Threatray	1'312 similar samples on MalwareBazaar
TLSH	T10BF41260BD299711CDB84BFE2C74967343B13E463930D6D92BC571F228D2F3453A9A26
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	e89eb44d8e172b44 (4 x Adware.Generic, 3 x AgentTesla, 1 x Formbook)
Reporter	abuse_ch
Tags:	AgentTesla DHL exe

abuse_ch

AgentTesla SMTP exfil server:
mail.controlfire.com.mx:587

Intelligence

File Origin

# of uploads :

# of downloads :

388

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

9897c1f7d4ecf7e68ba31bef6c909543d69c6bbd95a17d061f45ed13f4b92bfd.exe

Verdict:

Malicious activity

Analysis date:

2024-06-02 13:26:44 UTC

Tags:

evasion smtp exfiltration stealer agenttesla

Link:

https://app.any.run/tasks/1b2a310c-058b-4594-9a59-50ea87001120

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.Packed2.46843.24178.26644.UNOFFICIAL

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=665c7b3d29ebcd67665cc410win7simulatehigh_evasion

Tags:

Encryption Network Static Gensteal

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Reading critical registry keys

Stealing user critical data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

masquerade overlay packed

Link:

https://www.filescan.io/uploads/665c72ed0bf5978c0b0b66b6/reports/03b9f037-ac6c-4bed-adf2-217933856f27/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/9897c1f7d4ecf7e68ba31bef6c909543d69c6bbd95a17d061f45ed13f4b92bfd

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3b48b4f6-42d6-4ecd-937f-cda1561f1d4d

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1450602

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Check if machine is in data center or colocation facility

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9897c1f7d4ecf7e68ba31bef6c909543d69c6bbd95a17d061f45ed13f4b92bfd

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9897c1f7d4ecf7e68ba31bef6c909543d69c6bbd95a17d061f45ed13f4b92bfd/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2024-05-31 15:50:21 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=tcl4d56u5t36nc5ddpxwzeevipljy255swqx2bq7ixwrh5fzfp6q._file

Verdict:

malicious

Label(s):

agenttesla_v4

agenttesla

AgentTesla

4f6463b100f7812cc3d70de6abf38bd48290132ed93bc275fcedc5ef7571ff59

AgentTesla

5f6d0070aa1b62cfb032d99a822b585b79d1d66125cbf16fe03d7840f89cf7cf

AgentTesla

f2e1790a36ac95e802bdac123aede4a277b2a7da39ea9b6e399f9545dac51a50

AgentTesla

+ 1'302 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/240602-qphszaec32/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/dcc02066-e197-48db-bf4d-3beae19f9d80

Unpacked files

SH256 hash:

4ed3b0a80feebddd6441815ea99334d7eab55813713a9aa2953412b767405bb8

MD5 hash:

e472f83fa7fb92da892e8ebda9d92112

SHA1 hash:

af8477c3b9530134042aed375122d395d91879e8

Link:

https://www.unpac.me/results/a3fafb4f-303e-41fa-812d-0a7cac2efb70/

SH256 hash:

c8bbd9e433eba246736cedbd1c3f94421900c0941d71c55e44922f508e74deca

MD5 hash:

647b75bd5e9a14dc739faa84e26199fd

SHA1 hash:

a9ee22c6d80b96fbbcdd41c86421a57f3afee25b

Link:

https://www.unpac.me/results/a3fafb4f-303e-41fa-812d-0a7cac2efb70/

SH256 hash:

837fbe9b83e066eb57abc2f94a7bbfa1ce5c6189bdea605a9c74bbb11cdab57a

MD5 hash:

eb34eabec4f015fb2c9d8949545dc480

SHA1 hash:

88a60a7b15406d5fee25f5c174ad0547f6d8bca9

Detections:

AgentTesla

win_agent_tesla_g2

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Agenttesla_type2

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Link:

https://www.unpac.me/results/a3fafb4f-303e-41fa-812d-0a7cac2efb70/

Parent samples :

837fbe9b83e066eb57abc2f94a7bbfa1ce5c6189bdea605a9c74bbb11cdab57a
89d69f0365c11bc349cd92ad79cd3066b2225fe41dc2def83deef2661dea01a2
a745b4a8dbdad5c84183ce33793aac75423bdb99fd3a3fca646fbeb66e1059f2
9a31156b6d7eb6076d0bb4a2f593fc21be304aa9e559547e2ee4a6232608c35e
9897c1f7d4ecf7e68ba31bef6c909543d69c6bbd95a17d061f45ed13f4b92bfd
1723b52fb0a05e96e165eda1385729bc64d02ae86afaaa3d1661637ec2d27192
6c0748b811be208d404f519d342c5d63faa2e0dcfefe64131d6ed500285eb0f4
69b1e423fcc489f982d8aeae0cbeee56140b7d8a8810a8c98a7dee8424c00174
2fc7d83ec6fcdfaa540dd36add9c20c880ff865927530305d736af40c8bbce6c
142fb3857b4ca67fa862800dc443d4e405f419e1699d1c31de66d913ef038b15
ec0b5ee59f4421a87c7f912e1af5f27d9e1ae135ffdc07cdd646d1b877c8c6ec
f3b2e714a23ff2060a9f40f574727b5916363b45266653849d6aa5775a51f051

SH256 hash:

8e257246eaacccee415a832d25bf9affcc132b15dcc66a98d98231b46940a74f

MD5 hash:

995332c7facb6b9f5eba54390282c1ef

SHA1 hash:

55d4c6467696a48a2ca00b35f9a4319fb7894f10

Link:

https://www.unpac.me/results/a3fafb4f-303e-41fa-812d-0a7cac2efb70/

SH256 hash:

9897c1f7d4ecf7e68ba31bef6c909543d69c6bbd95a17d061f45ed13f4b92bfd

MD5 hash:

ae89ade9f160589390e9c250484ca6b2

SHA1 hash:

4265826ce0e9c88336c44334289c570df5b37309

Detections:

INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438

Link:

https://www.unpac.me/results/a3fafb4f-303e-41fa-812d-0a7cac2efb70/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.75

Link:

https://yomi.yoroi.company/submissions/9897c1f7d4ecf7e68ba31bef6c909543d69c6bbd95a17d061f45ed13f4b92bfd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample