MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98deae75edc9cd98e7a48e3727fd7e0237532b37e5388d97e9b2bdcd9c1393bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98deae75edc9cd98e7a48e3727fd7e0237532b37e5388d97e9b2bdcd9c1393bd
SHA3-384 hash: e85e6f97a3788d30c01bade0bc3578b83bfe20a3ce58d41b837c0f07e80027e8f958be8c24c08814c9f813f9b8ae338e
SHA1 hash: ace7415c737c6af9643d3beadc4d6aad246db6c9
MD5 hash: a6465c976a97f106fd261f5f263ee24d
humanhash: vermont-helium-salami-mike
File name:SecuriteInfo.com.W32.AIDetectNet.01.14291.9600
Download: download sample
Signature AgentTesla
Create hunting rule
File size:947'200 bytes
First seen:2022-06-22 14:37:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:UO4J1YivcYiOw9F0vw9FEY9lw9FDr1/cSGxKT7YiOw9F0cYiDw9F0cYiOw9F0:D8FvSOGGvGDlGhfVTOGGSDGGSOGG
Threatray 17'690 similar samples on MalwareBazaar
TLSH T13315021035C0E316C26F1E7B197151110B38FA963E66EA1F6C8751EF066A74A0A1FFAF
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/282318/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.14291.9600.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Searching for the window
Creating a window
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process from a recently created file
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Sending an HTTP GET request
Stealing user critical data
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
60%
Tags:
fareit packed wacatac
Link:
https://www.filescan.io/uploads/62b3295049d6271f1a77003a/reports/25397369-83b9-434b-a010-05c32ad5a0df/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e17269be-5c69-4e21-a88a-9215676d1052
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1017982
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 650478 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 22/06/2022 Architecture: WINDOWS Score: 100 41 Malicious sample detected (through community Yara rule) 2->41 43 Multi AV Scanner detection for dropped file 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 7 other signatures 2->47 7 SecuriteInfo.com.W32.AIDetectNet.01.14291.exe 7 2->7         started        process3 file4 27 C:\Users\user\AppData\Roaming\jswqvKZGq.exe, PE32 7->27 dropped 29 C:\Users\...\jswqvKZGq.exe:Zone.Identifier, ASCII 7->29 dropped 31 C:\Users\user\AppData\Local\...\tmp490C.tmp, XML 7->31 dropped 33 SecuriteInfo.com.W...et.01.14291.exe.log, ASCII 7->33 dropped 49 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->49 51 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->51 53 Uses schtasks.exe or at.exe to add and modify task schedules 7->53 55 2 other signatures 7->55 11 SecuriteInfo.com.W32.AIDetectNet.01.14291.exe 7->11         started        15 powershell.exe 24 7->15         started        17 powershell.exe 25 7->17         started        19 schtasks.exe 7->19         started        signatures5 process6 dnsIp7 35 smtp.yandex.ru 77.88.21.158, 49757, 49758, 587 YANDEXRU Russian Federation 11->35 37 192.168.2.1 unknown unknown 11->37 39 smtp.yandex.com 11->39 57 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->57 59 Tries to steal Mail credentials (via file / registry access) 11->59 61 Tries to harvest and steal ftp login credentials 11->61 63 2 other signatures 11->63 21 conhost.exe 15->21         started        23 conhost.exe 17->23         started        25 conhost.exe 19->25         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/98deae75edc9cd98e7a48e3727fd7e0237532b37e5388d97e9b2bdcd9c1393bd/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-22 12:19:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
52
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tdpk45pnzhgzrz5ery3sp7l6ai3vgkzx4u4i3f7jwk643hatso6q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0b9605fc1dac92e236a85b791b44cca1e7966a71644d3739bf5b664b92e8300e
AgentTesla
1a8d9888103b10597efba13da4fd7938444cf181a493a6063925d18df3fefdcf
AgentTesla
361aefa20296e948087c008c5406e913b904822b7211c39b671d2f202dcd59fa
AgentTesla
3f872756296b53c316f01ae3ee5e5ebb450d5de23dfa1c08c393dec76decf4fb
AgentTesla
74d6ab7e54de5496295eed575e8825fa1fbd8d97edf2b9d3eb3a739c79c50f90
AgentTesla
7df2d256518cec4656c0ab236d2b26e2d7976382ab75eb0326b5b8c463a6821d
AgentTesla
b484edef2132ebb9af301e05295fd56bc7298db9fbb8c6ce43b6297950b0e4e2
AgentTesla
ec41178b5e3b1cca0392b54fad427a9a4f2f9e354d0fdf392ae44662b6aa2720
AgentTesla
+ 17'680 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220622-rzp6gahack/
Behaviour
Creates scheduled task(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
6d7f3ebec2c65f73721d0661f0335cf4184fe18269cd1436709fa5d052786840
MD5 hash:
9ddd5690df13005ced72c22b9ef7eb0d
SHA1 hash:
d4aa5d93d6ec9dd885308b4ec41bd51aadc0870d
Link:
https://www.unpac.me/results/407e8316-de6a-482a-98a4-c5c8ee88ac0b/
SH256 hash:
0cb6aef1fa57d11408e47ae071485ef8f48c2982997b8d74b47a4151d85b978c
MD5 hash:
843aa6edf83bff7b61c6a5369ef41e95
SHA1 hash:
d1bfeec8eaac9a1dacf2f7062ce964d8e7d77085
Link:
https://www.unpac.me/results/407e8316-de6a-482a-98a4-c5c8ee88ac0b/
SH256 hash:
6e0af5a7e845858a03b4af1065452af355a83ca4256244af73e227dba8da2179
MD5 hash:
5999d7f101fcfc33a34a98128e1f8c95
SHA1 hash:
640a21e3ceda231eebb7c19c85e0294526c55826
Link:
https://www.unpac.me/results/407e8316-de6a-482a-98a4-c5c8ee88ac0b/
SH256 hash:
cd860c5a6feaf49cd86068a9b5575ded9efd4cedca2044ff32793a3c00067b12
MD5 hash:
4ecd2ac1839278f79ef9bab91d7c34df
SHA1 hash:
516acadeb673065056b19ff2b13ca9b6ab5520b7
Link:
https://www.unpac.me/results/407e8316-de6a-482a-98a4-c5c8ee88ac0b/
SH256 hash:
880c9ff80de33cde042ab26d75677dab18fdc7695908d615c44efa8b5d8e088a
MD5 hash:
07e1e5baea35d75e784cce3b991a5fdc
SHA1 hash:
2f5cd9ad4acec13ddb49f9d69093f9fe475342c2
Link:
https://www.unpac.me/results/407e8316-de6a-482a-98a4-c5c8ee88ac0b/
SH256 hash:
98deae75edc9cd98e7a48e3727fd7e0237532b37e5388d97e9b2bdcd9c1393bd
MD5 hash:
a6465c976a97f106fd261f5f263ee24d
SHA1 hash:
ace7415c737c6af9643d3beadc4d6aad246db6c9
Link:
https://www.unpac.me/results/407e8316-de6a-482a-98a4-c5c8ee88ac0b/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/98deae75edc9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/98deae75edc9cd98e7a48e3727fd7e0237532b37e5388d97e9b2bdcd9c1393bd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/282318/

Comments