MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c18f7c761ef5854d1b3dd4b3176db9def2bd4b324f15aeffe4e995a1c6d5d79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c18f7c761ef5854d1b3dd4b3176db9def2bd4b324f15aeffe4e995a1c6d5d79
SHA3-384 hash: 681b84674caaf2e343703948f95905d3c574b936c969e97fe9bccf32fba229b11dd08088d8b8c7fcdbbb2ae26fac90ab
SHA1 hash: bf5f6b6dec25c9d9be3d4dc125f6ce539c5c38e9
MD5 hash: 62ae2974d01fd8439ec141a63fc423f8
humanhash: early-william-seventeen-chicken
File name:TELEX BI 14226INS00075.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:559'616 bytes
First seen:2022-05-12 08:52:16 UTC
Last seen:2022-05-12 10:24:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:08ehJcPEOGb9ZJK7OEl6S6gAu2ijACY2W9uc99ACif4:0dhu8f9ZJBS6bHu9jACY2mx99tif4
Threatray 17'311 similar samples on MalwareBazaar
TLSH T13AC41229B7638912C66E0A3ADCD520DC0371AF036C13EB1F5DD8329D4B767D60D94AAB
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
241
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/270012/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/627ccaff7804b2efc491c178/reports/32dc7911-20e6-485d-9dad-ee81e32f95e7/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ae531c04-d5d3-4e96-84d1-3428e1cc78ca
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/992545
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the hosts file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9c18f7c761ef5854d1b3dd4b3176db9def2bd4b324f15aeffe4e995a1c6d5d79/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-12 08:53:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tqmppr3b55mfjunt3vftc5w3txxsxvftetyvv376j2mvuhdnlv4q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
03fb638724597e20f6102deff728cdd8265eecc3f08e54e373c304b4c0718c42
AgentTesla
58662a541e967957fb29666739766952c7379969a44bd73dfb5ec22e8fc2993b
AgentTesla
640c647769b22714c9bd5029c10cd5d3c1d863c5320b24911371183e285ebf4e
AgentTesla
845552c3b6efd3b155eebf54ef7cbff7d2e5072da68575c243dfa44e39d9aeb4
AgentTesla
8e5ed115b7473306fd41dc1862d463a22e1918369e83a8c2d97bc3498af5f93e
AgentTesla
9c071afc054e8a65329317a6b449e9f4119a5546c2b3a5c2ce9bf2cb1a04a46e
AgentTesla
9c18f7c761ef5854d1b3dd4b3176db9def2bd4b324f15aeffe4e995a1c6d5d79
AgentTesla
b5392efbc51d739297f56abfee8699e58ea304de1e9d1ef55a73b39daa35254f
AgentTesla
dbeaed64df79acb9ca2c3020a521ffcdf044257d29f3fb35e2469015e952f438
AgentTesla
fa55b06000b6dce4eacaf3509635e9ade98a0b09fd08ab86f5c13920a782ac92
AgentTesla
+ 17'301 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220512-ktap9seecr/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla
Unpacked files
SH256 hash:
c206122a7336385be557580c114ac0923192f61bc8f77aa58c898135438399f9
MD5 hash:
6c9e813248a01432890c476813d210b8
SHA1 hash:
fd54aa3af58fc3a88cb3fd6753d773cd6c51b7f8
Link:
https://www.unpac.me/results/5f843a35-6246-4014-b37e-722acf415632/
SH256 hash:
a4935865f22198eac5867051ec020723058efcb47f2be8a83e55711341316fde
MD5 hash:
7098d36f69c2f1596f279b41ecced0fe
SHA1 hash:
edcbc6debd65305a8c95540673799469aec49b6c
Link:
https://www.unpac.me/results/5f843a35-6246-4014-b37e-722acf415632/
SH256 hash:
831ad993ded87071fae09766fe3bfdd50fbc135f9bdfcbb29425b00b68d61419
MD5 hash:
65f942ca5cb038796fcb2e8b03605771
SHA1 hash:
7960af986cafa0aea67098a3643e14363d0ccb2e
Link:
https://www.unpac.me/results/5f843a35-6246-4014-b37e-722acf415632/
SH256 hash:
9c36e186ac10a0933115a60ad1255b795bfe129681af4f596c90bd5066541fe2
MD5 hash:
aa15acb4b7e314596baf1b81d4e770e9
SHA1 hash:
1521863d5afb0ca60144c06b68e93f16360c5b39
Link:
https://www.unpac.me/results/5f843a35-6246-4014-b37e-722acf415632/
SH256 hash:
9c18f7c761ef5854d1b3dd4b3176db9def2bd4b324f15aeffe4e995a1c6d5d79
MD5 hash:
62ae2974d01fd8439ec141a63fc423f8
SHA1 hash:
bf5f6b6dec25c9d9be3d4dc125f6ce539c5c38e9
Link:
https://www.unpac.me/results/5f843a35-6246-4014-b37e-722acf415632/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9c18f7c761ef/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9c18f7c761ef5854d1b3dd4b3176db9def2bd4b324f15aeffe4e995a1c6d5d79

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r09 6201b0b40a56becc8b7089416a38e27fd15c6e7829ba72117b0973333c18f1f7

AgentTesla

Executable exe 9c18f7c761ef5854d1b3dd4b3176db9def2bd4b324f15aeffe4e995a1c6d5d79

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 6201b0b40a56becc8b7089416a38e27fd15c6e7829ba72117b0973333c18f1f7
Cape
Cape
https://www.capesandbox.com/analysis/270012/
  
Dropped by
MD5 58e50e85801850d8e571ac660b0f3aa7

Comments