MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f05a25d30b22c3d4a8da65f3ef034fc24ed35b97ed418f79d3af4def9f7ccdf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f05a25d30b22c3d4a8da65f3ef034fc24ed35b97ed418f79d3af4def9f7ccdf
SHA3-384 hash: 1fcb5f2535908cd0cce092b49a98513b418977d58e48c125b7a9b795a2fd837b067b0541c6407b5b94afd3a7f07a0ae6
SHA1 hash: 501ff4d1dbdc118de90a530e5612bae87386ea0a
MD5 hash: 21326b38b8dc273123fa234df6c0c62e
humanhash: winner-east-ack-mockingbird
File name:PAYMENT FOR INV.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:727'040 bytes
First seen:2023-05-30 06:40:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:HHkmFx2iqNhujGjUdSOvOTQCGZZn/OsTp5i0OGNJPDIMBEAq67qK:HEmFxUeCkZ2sd5i05dDIMBEh67qK
Threatray 4'369 similar samples on MalwareBazaar
TLSH T135F4120522B68737C03F53FEA0662A7403F9668E3266F3064EE3B1DE6F9AF450955903
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
242
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PAYMENT FOR INV.exe
Verdict:
Suspicious activity
Analysis date:
2023-05-30 06:43:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6bfd5447-871d-48be-acc8-d0201454c9f6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/393294/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.67286583.111.188.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64759a7e6dd70dc931d855ed/reports/3549e00e-c733-494e-85de-bc04b678877e/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/9f05a25d30b22c3d4a8da65f3ef034fc24ed35b97ed418f79d3af4def9f7ccdf
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5c5e642c-18fa-4679-89ae-ee910dc21799
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1245535
Signature
.NET source code contains potential unpacker
Found malware configuration
Initial sample is a PE file and has a suspicious name
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f05a25d30b22c3d4a8da65f3ef034fc24ed35b97ed418f79d3af4def9f7ccdf/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-05-29 05:26:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
15 of 24 (62.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t4c2exjqwiwd2sunuzpt54bu7qso2nnzp3kbr545hl2n56pxztpq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0709f9e2f76a07b22aa5361179d7120bd8127fc42a0f5c289f73e8f764460092
AgentTesla
487684e01b232a60cff5d2eb9c1a438e3b6545a6e2610771084079bdf42764fd
AgentTesla
5404c10cf88a5d915b78fcc822cb3ba3139ad4ed9cdacbf6c82dd070c4e1bc4b
AgentTesla
57d148e97edd36a56b6cb5fdfae00c5224b198f9660426e68f4a0555844d803b
AgentTesla
734da354d0b8c982d436b43e4f8e105382af3d08def6114dfa685d1230bf64dc
AgentTesla
a21042691ca3daa975ce1a24fba6115f2d762eef39cbaffd4245d582d286ea84
AgentTesla
aa3e87c3886fe443df71b65dc484b40811a253f1ac642a70c59653912a8a467f
AgentTesla
affbd34bdaf31dc32de0d83100925f880bea333c43dcaf0646cc5bd57e17066b
AgentTesla
fc39a3e6bd87bd2f7a2247a2270e17b5b6b061ba64723c0c582d53d80a3448e8
AgentTesla
feb3a8fc0da4f632c7aeb9a19460d04f5881f592b5458988dfa61aa0fdc00d7e
AgentTesla
+ 4'359 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230530-hfr2aaga8z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
6be547487de2037e2c7892e6ff7a0da573531f34f27dbee2acf123ce7a3ce9ad
MD5 hash:
55e6e11f0adf94ac19a71ee7f1433279
SHA1 hash:
c9edc0ff2ba047aaaabcdbf1a7e70ec825a0f6f1
Link:
https://www.unpac.me/results/ff80610a-3a62-4117-80d0-dcdec1f200ad/
SH256 hash:
251e8c98dc79a3c5bf96352b904c44da9f8144d19655af238267376ec439a869
MD5 hash:
469a0d56424f245d7303806583b195b5
SHA1 hash:
ba666746f3aea44c7d37f76e15931c5accec7daf
Link:
https://www.unpac.me/results/ff80610a-3a62-4117-80d0-dcdec1f200ad/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/ff80610a-3a62-4117-80d0-dcdec1f200ad/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
0b861d0e19d173621dba77fc3954b6325b3e89e0856817eb9ac1b0e4b4b6f9a0
MD5 hash:
34e9924238cc9c184aed0f7e0dd905ab
SHA1 hash:
42e0e3852a327ae2d232858ba41fca9cadd628db
Link:
https://www.unpac.me/results/ff80610a-3a62-4117-80d0-dcdec1f200ad/
SH256 hash:
0ba7558af6446cfd6fb0653de7a172326efcf7527d2e1befd063678ea2ec37bf
MD5 hash:
9079fa75c5aebcca294b91307bdee0a5
SHA1 hash:
3c3290ff4fb74a051c8ac461b2d52692bb8fa3c2
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/ff80610a-3a62-4117-80d0-dcdec1f200ad/
Parent samples :
9f05a25d30b22c3d4a8da65f3ef034fc24ed35b97ed418f79d3af4def9f7ccdf
4a06dad3c257f41ddde074d091dbb4fcaf4a4c1d6404bca42c628af3209540a5
SH256 hash:
9f05a25d30b22c3d4a8da65f3ef034fc24ed35b97ed418f79d3af4def9f7ccdf
MD5 hash:
21326b38b8dc273123fa234df6c0c62e
SHA1 hash:
501ff4d1dbdc118de90a530e5612bae87386ea0a
Link:
https://www.unpac.me/results/ff80610a-3a62-4117-80d0-dcdec1f200ad/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9f05a25d30b2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9f05a25d30b22c3d4a8da65f3ef034fc24ed35b97ed418f79d3af4def9f7ccdf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:msil_susp_obf_xorstringsnet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 9f05a25d30b22c3d4a8da65f3ef034fc24ed35b97ed418f79d3af4def9f7ccdf

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/393294/

Comments