MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0669c333cd5683b938d7525828022547ddcaa61e924ca7f4a29e484d0c7100a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a0669c333cd5683b938d7525828022547ddcaa61e924ca7f4a29e484d0c7100a
SHA3-384 hash: 5c8561dda0cbd379d6f82ecde3f4f6b38d9af4e0b8c1cdad7efce13cd2055b1aecf56c6197f90033a091386ac2ad87a8
SHA1 hash: 4c31f2f1b179be26a515c73c7b22f31c08159ce6
MD5 hash: d0b9a0bc96f05b7b782bd191113c3555
humanhash: stairway-edward-batman-autumn
File name:SecuriteInfo.com.W32.AIDetectNet.01.19537.20769
Download: download sample
Signature AgentTesla
Create hunting rule
File size:770'048 bytes
First seen:2022-07-20 17:37:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:3JLVnbp031huTOhEceLclua/Z4Km18t0iGjQQluvKhmXmPFf:HbpouqSceLc+14ZGjQMuvKEmNf
Threatray 18'175 similar samples on MalwareBazaar
TLSH T123F4D0047657DD13C27C13B7D0C2005887B58A06A16EDBCBBECA22E65B06BE6DDC9787
TrID 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b271c0cccccc61b2 (16 x AgentTesla, 8 x Loki, 8 x SnakeKeylogger)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
351
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/292964/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.19537.20769.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62d83dd4ee649612ac5d8ae8/reports/2e8890fe-b07d-43c3-af97-148b735f62a5/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1037792
Behaviour
Behavior Graph:
n/a
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a0669c333cd5683b938d7525828022547ddcaa61e924ca7f4a29e484d0c7100a/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2022-07-20 17:38:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
31
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ubtjymz42vudxe4nousyfabckr65zktb5esmu72kfhsijughcafa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
128db20afc0741c8be717aee35267d50d219d694857978d6faa1710a6a9ab4af
AgentTesla
17fdcc607fd88eae0d0c1c70bbb2d0142fab586b95fc5952b63e568b5456b01d
AgentTesla
363972a28cb3e26bc9881c34d2ff911c3c2570dffea4ae7d6e54056a2a988390
AgentTesla
4b50ad683aa4fa64ea52f33f77fdee2ee70c1c98bae14f75982469520830cc55
AgentTesla
e4d2da009a40f7b1fbd7c9a488d521b5e035ebcd26ada683ea837aaf4b51a0d7
AgentTesla
ef2a15f6b8ccb195d4f9be0206ddf6cf6db68ea4e7d6d73cc09df10402d1e2c3
AgentTesla
+ 18'165 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220720-v7prfsdca8/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
AgentTesla payload
AgentTesla
Unpacked files
SH256 hash:
39c2d879c57f07305ce60412dc8a88f02e51f1a14a06cc605768d1d7f5313807
MD5 hash:
db51fe170a9e5d6ec5429a2fbd9d0353
SHA1 hash:
e30a58125fc41322db6cf2ccb6a6d414ed379016
Link:
https://www.unpac.me/results/42653a5b-74f4-4d70-91c7-d66e9abc2d91/
SH256 hash:
cd51a760e78822c1ec451a6b97d5d077772a36b06ddb7b246ca3115fda1c01f9
MD5 hash:
e962e63c672a49213ea410019631a18f
SHA1 hash:
c87d71d0c900a798dfee363ab43691b13f940ac4
Link:
https://www.unpac.me/results/42653a5b-74f4-4d70-91c7-d66e9abc2d91/
SH256 hash:
ca4e3745f87ae419e10fa9dd15e9814f66a7dca601ae70bd3ae3b0b0781e9491
MD5 hash:
6491ab64072f34a6124f4cdf1d9bdd43
SHA1 hash:
78008e0c188d1732ebb5bbfe6d15892ebe32b1f7
Link:
https://www.unpac.me/results/42653a5b-74f4-4d70-91c7-d66e9abc2d91/
SH256 hash:
5e8f5a3ab79e6a30087957fe2c2e64d9cf2901a21c7bcf830cac9809d8be9553
MD5 hash:
5f9c12c3a0cca5d9148200431298012c
SHA1 hash:
5a15fa406476347562e138cc4c98cc9d6a3d345d
Link:
https://www.unpac.me/results/42653a5b-74f4-4d70-91c7-d66e9abc2d91/
SH256 hash:
1885812eb4c46004f9e0c28be5d0f49c4a8d3d84958472395a7d116305d858d0
MD5 hash:
4dad96248802c6a7392c1f6c4d57b6ea
SHA1 hash:
421473d51d703c1d6c92b5aa9b60fe3d67326e43
Link:
https://www.unpac.me/results/42653a5b-74f4-4d70-91c7-d66e9abc2d91/
SH256 hash:
a0669c333cd5683b938d7525828022547ddcaa61e924ca7f4a29e484d0c7100a
MD5 hash:
d0b9a0bc96f05b7b782bd191113c3555
SHA1 hash:
4c31f2f1b179be26a515c73c7b22f31c08159ce6
Link:
https://www.unpac.me/results/42653a5b-74f4-4d70-91c7-d66e9abc2d91/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a0669c333cd5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a0669c333cd5683b938d7525828022547ddcaa61e924ca7f4a29e484d0c7100a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/292964/

Comments