MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a4101ed91c9c07c3814605532429c9aab06431d50f0e79cb2e57737bc8d96d8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 14
| SHA256 hash: | a4101ed91c9c07c3814605532429c9aab06431d50f0e79cb2e57737bc8d96d8b |
|---|---|
| SHA3-384 hash: | 4209bc26c0e1dbf5c24790e03835748e9618eb27e66ac6eaa1af811715cec530c3b5d048f44a014c771e05267bde24b8 |
| SHA1 hash: | bff54dcebdda0e19b51a786ed999483d1a183741 |
| MD5 hash: | 408a69f67a416c4f5945796a93bb9f36 |
| humanhash: | earth-zulu-march-massachusetts |
| File name: | Proforma Invoice#77634364366.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 772'608 bytes |
| First seen: | 2023-04-27 09:02:13 UTC |
| Last seen: | 2023-05-13 22:55:41 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:g/SIkq8h3WubAzaTIbigxDnQ2VtjtluHDGxHO+ZU+1Fx:WS4ubAzaTEBQ6tjtluHDAHz6+v |
| Threatray | 2'643 similar samples on MalwareBazaar |
| TLSH | T174F4F53C28BD1627C57AD7E58FD08427B664956B7121EE24ACC7A3E60306F1269C363F |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  TeamDreier |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
3
# of downloads :
289
Origin country :
DKVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Proforma Invoice#77634364366.exe
Verdict:
Malicious activity
Analysis date:
2023-04-27 09:04:23 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
formbook packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
AgentTesla, zgRAT
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to register a low level keyboard hook
Found malware configuration
Initial sample is a PE file and has a suspicious name
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected zgRAT
Behaviour
Behavior Graph:
Threat name:
Win32.Spyware.Negasteal
Status:
Malicious
First seen:
2023-04-26 16:37:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
17 of 24 (70.83%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 2'633 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
156f27b89a8a662b7ed1d1254fbc0958c24d96ce6c0599f1250403cce0e621ef
MD5 hash:
89316f58aaed4d94d776ecfa05632a18
SHA1 hash:
f6bd0a6ac567ec71267dcf7574ab09205bfefacf
Detections:
AgentTeslaXorStringsNet
SH256 hash:
21f0154b51a09767f94922b81f5fcd15cf4a6390ab7314e40d0e17b2dcdfe6ba
MD5 hash:
c926563698de3a89ad20474c85122f73
SHA1 hash:
ed1a3b2527ace111e6f39880c7ee3965f301330d
SH256 hash:
58d2780bac07a53fa9ef0099c386ad23c2c5b83df99e18bbcca9895f829ef5d8
MD5 hash:
3a6ac846fbf56df68c3cb61cd18c7623
SHA1 hash:
e5b7f4e47b357f330b33330663ff5739a02d442f
SH256 hash:
7641caa3444bacc9ea8a1f794b633ee8001e2bc7c723455d8f71c3430d699955
MD5 hash:
d59ba44ec9de4145145da671c41a70d4
SHA1 hash:
d976d8b10f32b2da60a1688ae5f6667eb6022f0a
SH256 hash:
b1fc3c7ff4586c4203c27b2f1e5a510313072a561ce67ec69d52794c3a4785f6
MD5 hash:
b7361785dedcaebe943176118b68cb51
SHA1 hash:
2dff34f828ef0641adef84f55bfc73ceddf23463
SH256 hash:
a4101ed91c9c07c3814605532429c9aab06431d50f0e79cb2e57737bc8d96d8b
MD5 hash:
408a69f67a416c4f5945796a93bb9f36
SHA1 hash:
bff54dcebdda0e19b51a786ed999483d1a183741
Malware family:
AgentTesla.v4
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.