MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ad8a600ef80dda6989189726d0bcf0ec22618d71e5111736f1a1befaf2d6ab5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ad8a600ef80dda6989189726d0bcf0ec22618d71e5111736f1a1befaf2d6ab5
SHA3-384 hash: c10b5d2843a3bf320ac5301c387da56e12cd7255715e0915d9c8f8df043277ea28c2f98405ff1e116213054a7c60215c
SHA1 hash: 4b539cc4111e86063e668f0f5ac178f1aa83830a
MD5 hash: 9c422c8e92ef0a830f21053321603ab2
humanhash: virginia-golf-apart-tennis
File name:9ad8a600ef80dda6989189726d0bcf0ec22618d71e5111736f1a1befaf2d6ab5
Download: download sample
Signature AgentTesla
Create hunting rule
File size:673'792 bytes
First seen:2023-05-14 09:42:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:Rtdqmj8aaJCGcGvN+VLEeYgNSzGEZ0v7pUfKMkGZSkW/HeKZc8:NZj8lCPGvNCAebNbp2SrZz
Threatray 3'480 similar samples on MalwareBazaar
TLSH T19DE4D0132069CD8AFD2EC735D464FBF421B5BCB3D8D59523277A3C89F9BAB01190825A
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon c0f43ebeb45012b2 (7 x AgentTesla, 4 x Loki, 2 x Formbook)
Reporter petikvx
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
send.zip
Verdict:
Malicious activity
Analysis date:
2023-05-05 01:57:03 UTC
Tags:
rat redline trojan amadey loader keylogger remcos evasion kelihos snake miner lokibot stealer vidar formbook arkei PurpleFox aurorastealer raccoon recordbreaker backdoor dcrat xloader
Link:
https://app.any.run/tasks/1703e4ff-c419-442b-9c14-1e20ff2e7c21

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XorStringsNET
Create hunting rule
Link:
https://www.capesandbox.com/analysis/389326/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.66783929.1609.22573.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6460ad2dca26a28d5b9158f1/reports/3fbc38b4-f5c6-4a37-8382-6a7df79276f5/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/9ad8a600ef80dda6989189726d0bcf0ec22618d71e5111736f1a1befaf2d6ab5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/40cb4738-bbf1-4d86-898d-269d5f27bdd3
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1232727
Signature
.NET source code contains potential unpacker
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 865705 Sample: Z4dAvAJmcQ.exe Startdate: 14/05/2023 Architecture: WINDOWS Score: 100 53 Found malware configuration 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 Yara detected AgentTesla 2->57 59 3 other signatures 2->59 6 Z4dAvAJmcQ.exe 3 2->6         started        10 RMBJLaF.exe 3 2->10         started        12 RMBJLaF.exe 2 2->12         started        process3 file4 29 C:\Users\user\AppData\...\Z4dAvAJmcQ.exe.log, CSV 6->29 dropped 61 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->61 63 May check the online IP address of the machine 6->63 14 Z4dAvAJmcQ.exe 17 5 6->14         started        65 Multi AV Scanner detection for dropped file 10->65 67 Machine Learning detection for dropped file 10->67 19 RMBJLaF.exe 14 2 10->19         started        21 RMBJLaF.exe 12->21         started        23 RMBJLaF.exe 12->23         started        25 RMBJLaF.exe 12->25         started        27 2 other processes 12->27 signatures5 process6 dnsIp7 35 api4.ipify.org 173.231.16.77, 443, 49679, 49685 WEBNXUS United States 14->35 37 server320.web-hosting.com 198.54.121.225, 25, 49684, 49687 NAMECHEAP-NETUS United States 14->37 39 api.ipify.org 14->39 31 C:\Users\user\AppData\Roaming\...\RMBJLaF.exe, PE32 14->31 dropped 33 C:\Users\user\...\RMBJLaF.exe:Zone.Identifier, ASCII 14->33 dropped 45 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->45 47 Tries to steal Mail credentials (via file / registry access) 14->47 49 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->49 41 api.ipify.org 19->41 43 api.ipify.org 21->43 51 Tries to harvest and steal browser information (history, passwords, etc) 21->51 file8 signatures9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9ad8a600ef80dda6989189726d0bcf0ec22618d71e5111736f1a1befaf2d6ab5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-01 05:47:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
26 of 37 (70.27%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tlmkmahpqdo2ngerrfzg2c6pb3bcmggxdzirc43pdin67lznnk2q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1c5cc71cd847d8a2679ec629b631b4d7e1082e7126022ab26ff015298d93a61e
AgentTesla
2d2e38443f4235d9d322fef4c3f27cb80889f16d9fc52e9cb0ea17f4df3d3af2
AgentTesla
aa3e87c3886fe443df71b65dc484b40811a253f1ac642a70c59653912a8a467f
AgentTesla
ba852b38002916eb89dd9ada1f1ff78c308b433732b1600813789f5707ab6d62
AgentTesla
c6e74929d1f5df0946833f77f1074f8a8518a642067b129dae1ad261ded796f2
AgentTesla
dd344c32dd59a635e9ebfec3a33f2242178c82498769b995d7fb1c47a34882c8
AgentTesla
+ 3'470 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230514-lpxvnsbe27/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
cdfbb13f62e4eb038c3566c5004293741afa31fc418fe1f80da6d1d5f74e052f
MD5 hash:
8332ccc3b48e71c3a734b191af386d01
SHA1 hash:
e0be0bf6f2176eb6cfff1cee090a549a14b72332
Link:
https://www.unpac.me/results/0e765ce1-c19c-4baa-a543-1688070792ac/
SH256 hash:
b630426cde12f02193729412d3d014fa0eec2a6cd2bf095a0e09891dc6ecf0b4
MD5 hash:
e87fe9e585b36f23f4e948edd20e65ca
SHA1 hash:
d035995d71de3c8465cfbe2d531a4bc9b2307127
Link:
https://www.unpac.me/results/0e765ce1-c19c-4baa-a543-1688070792ac/
SH256 hash:
0d34bbd8f1b13cadcbf158e777980061b6795fd81accd29825205aba00c01cd2
MD5 hash:
a5b325809c4a8fe7c12c56d45e74d8a8
SHA1 hash:
9f77583865f6f4d1467fa2e982be8c6a35723c6c
Link:
https://www.unpac.me/results/0e765ce1-c19c-4baa-a543-1688070792ac/
SH256 hash:
c8808b69b0f4d52c253e35b001da94086786b34162fd51daa3f17eda94bac7f0
MD5 hash:
da56041df789c24cb2a36a364431f766
SHA1 hash:
876e6c579d1092a76ce90c500c43af0cf11724a4
Link:
https://www.unpac.me/results/0e765ce1-c19c-4baa-a543-1688070792ac/
SH256 hash:
e693198489b01c99b9d46a01fa9370967966dfdecbf0a5ec670636befc83d5c5
MD5 hash:
c4b17c31b7118c91d7e2045aa42d7956
SHA1 hash:
7370f871333728f0945fde56357fd283358d997a
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/0e765ce1-c19c-4baa-a543-1688070792ac/
Parent samples :
9ad8a600ef80dda6989189726d0bcf0ec22618d71e5111736f1a1befaf2d6ab5
060cbd961bb22ca26578ec782af86ae672f6d39c9e06808889c4ba103a05221d
SH256 hash:
9ad8a600ef80dda6989189726d0bcf0ec22618d71e5111736f1a1befaf2d6ab5
MD5 hash:
9c422c8e92ef0a830f21053321603ab2
SHA1 hash:
4b539cc4111e86063e668f0f5ac178f1aa83830a
Link:
https://www.unpac.me/results/0e765ce1-c19c-4baa-a543-1688070792ac/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9ad8a600ef80/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/9ad8a600ef80dda6989189726d0bcf0ec22618d71e5111736f1a1befaf2d6ab5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 9ad8a600ef80dda6989189726d0bcf0ec22618d71e5111736f1a1befaf2d6ab5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2619730/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/389326/

Comments