MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4e65fda279dd5b0cf9a1f8c23ce34b9b202b854616d54dfbf03737743c1bcd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4e65fda279dd5b0cf9a1f8c23ce34b9b202b854616d54dfbf03737743c1bcd4
SHA3-384 hash: 3eedf6df2e8c69ba838de15fb9be2b3f280643819f9589d4f8e79d8f0df73fa99710c41119f250445703e5beaa664846
SHA1 hash: 9e12cb16ddd230d00f24f3689ce8613fc82fd5c0
MD5 hash: b363033bd401d271974418b454210688
humanhash: blue-oranges-tennessee-gee
File name:lN6UpV9zJAjEZ5Q.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:786'432 bytes
First seen:2023-01-24 12:52:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'640 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 12288:bKZMtEwcU3gZ+GQzjkATGdsaNdZLRmT/teWrChvh2ybhhMvrUU/5CueT4kSz1ViA:b46AAgZbQzlG1dJELIWr4/sr/EupkC7h
Threatray 23'982 similar samples on MalwareBazaar
TLSH T165F412432EA5B662C95487B37663861C03B66D0EBCF9E22F0D4EB2DFD6377848510A53
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 4c33d8d4d4d8324c (40 x AgentTesla, 23 x RedLineStealer, 15 x RemcosRAT)
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
lN6UpV9zJAjEZ5Q.exe
Verdict:
Malicious activity
Analysis date:
2023-01-24 12:52:59 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a38205f5-80af-497e-b017-14658dd70ff7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/356377/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bladabindi packed
Link:
https://www.filescan.io/uploads/63cfd4b02b351a3d0ea838c1/reports/1b6b33eb-9e20-4a8b-a22b-8d03c2643de8/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/57731f16-5c3a-45a0-a67e-c3057c9c334b
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1157879
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 790616 Sample: lN6UpV9zJAjEZ5Q.exe Startdate: 24/01/2023 Architecture: WINDOWS Score: 100 47 Malicious sample detected (through community Yara rule) 2->47 49 Antivirus / Scanner detection for submitted sample 2->49 51 Sigma detected: Scheduled temp file as task from temp location 2->51 53 7 other signatures 2->53 7 lN6UpV9zJAjEZ5Q.exe 7 2->7         started        11 WsXdcSlfGYol.exe 5 2->11         started        process3 file4 35 C:\Users\user\AppData\...\WsXdcSlfGYol.exe, PE32 7->35 dropped 37 C:\Users\...\WsXdcSlfGYol.exe:Zone.Identifier, ASCII 7->37 dropped 39 C:\Users\user\AppData\Local\...\tmp6C92.tmp, XML 7->39 dropped 41 C:\Users\user\...\lN6UpV9zJAjEZ5Q.exe.log, ASCII 7->41 dropped 55 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->55 57 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->57 59 Uses schtasks.exe or at.exe to add and modify task schedules 7->59 61 Adds a directory exclusion to Windows Defender 7->61 13 lN6UpV9zJAjEZ5Q.exe 2 7->13         started        17 powershell.exe 21 7->17         started        19 powershell.exe 22 7->19         started        21 schtasks.exe 1 7->21         started        63 Antivirus detection for dropped file 11->63 65 Multi AV Scanner detection for dropped file 11->65 67 Machine Learning detection for dropped file 11->67 23 WsXdcSlfGYol.exe 11->23         started        25 schtasks.exe 11->25         started        signatures5 process6 dnsIp7 43 madrid.servershost.net 191.96.133.98, 49704, 587 ASDETUKhttpwwwheficedcomGB Chile 13->43 69 Installs a global keyboard hook 13->69 27 conhost.exe 17->27         started        29 conhost.exe 19->29         started        31 conhost.exe 21->31         started        45 181.214.31.78, 49705, 587 ASDETUKhttpwwwheficedcomGB Chile 23->45 71 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 23->71 73 Tries to steal Mail credentials (via file / registry access) 23->73 75 Tries to harvest and steal browser information (history, passwords, etc) 23->75 33 conhost.exe 25->33         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a4e65fda279dd5b0cf9a1f8c23ce34b9b202b854616d54dfbf03737743c1bcd4/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uttf7wrhtxk3bt42d6gchtruxgzafocumfwvjx57anzxoq6bxtka._file
Verdict:
malicious
Similar samples:
01b0e10d7351007133aa2a5f1cef379b855706256fb70f327990ea142df772ad
AgentTesla
19f5de1fab76d8bdac9d3bab7ec590152f1b9b4f154d1c429a1fd1acb65ba628
AgentTesla
1f5d9074ca3f0cb21ca2e31560ff93491a57ea74466b5ff5a6ac0d63774029c6
AgentTesla
5a64665bdc77f9386891c1a251064decfdce7e9782bb4b47d95e2c14238d46f2
AgentTesla
5f1d6d9c49024913322423dbd249144d93feab55663e1cc26fb0cdf9eb16c610
AgentTesla
62a868ec8c1727bcddd3954bd37e482a5584bd40b7163132738885b7deffaa4f
AgentTesla
a84aad3732ea9ed162f345bddceeb44da8b25e0ab4fd4e55848c1804d00d652d
AgentTesla
ab07e5b2a5ec274e9684b2e86706cc0af428a30e9cd478a274ce21c78022dfc5
AgentTesla
b65c9b32608d8cb0f3fab995466eadf5461a471069dc7b801c3c5b14fa75fdb8
AgentTesla
f35b10b0e3e35686a822299fda274cae3a8eb0e1cb3e95cc1feac297c6429f29
AgentTesla
+ 23'972 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230124-p4l89sba98/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Unpacked files
SH256 hash:
3c1ce615b90002fd909480bc133c9eda32fffa61131f73f5e47deb93f3e584ac
MD5 hash:
36ff7cd3bb96ced1ade0f8969cddebf9
SHA1 hash:
e4b8e4c3ad8732bf15b23412706e736a2d659624
Link:
https://www.unpac.me/results/693e07fd-475b-4306-9991-a58d384fb64b/
SH256 hash:
411569f9f0b865c651adc1234d23f86cd98fe5cd641704702276e9882be113b6
MD5 hash:
7648892096f37af50468509c5b051180
SHA1 hash:
a56a074c2770152761f6c4975db0e9f7d57f8cda
Link:
https://www.unpac.me/results/693e07fd-475b-4306-9991-a58d384fb64b/
SH256 hash:
cd82d7db8aa7dbe7171e80b324ac693fcfef243c7f1690287e35aa620331bd2f
MD5 hash:
bb74fd9cd83230dbc3f6b56a11a1afd3
SHA1 hash:
8365b5425417ce64c7d4e6d686af867bd195e461
Link:
https://www.unpac.me/results/693e07fd-475b-4306-9991-a58d384fb64b/
SH256 hash:
68e1fb49cbe831a60475819fed2ed39458933428566aaac060f581decd175e68
MD5 hash:
44035dacfcfbce59f9c9489bb3fbb04e
SHA1 hash:
471c1542dece78971c5c64f84969e802fc48bac3
Link:
https://www.unpac.me/results/693e07fd-475b-4306-9991-a58d384fb64b/
SH256 hash:
ff1b42ea7d56a37eae801adbddb7116f52a4664c0b41302736f522852edc2747
MD5 hash:
89ac57478044c57c7195943116a521e0
SHA1 hash:
1ff2bafeed795423e3538d810bda8e1e3fcdcfa5
Link:
https://www.unpac.me/results/693e07fd-475b-4306-9991-a58d384fb64b/
SH256 hash:
a4e65fda279dd5b0cf9a1f8c23ce34b9b202b854616d54dfbf03737743c1bcd4
MD5 hash:
b363033bd401d271974418b454210688
SHA1 hash:
9e12cb16ddd230d00f24f3689ce8613fc82fd5c0
Link:
https://www.unpac.me/results/693e07fd-475b-4306-9991-a58d384fb64b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a4e65fda279dd5b0cf9a1f8c23ce34b9b202b854616d54dfbf03737743c1bcd4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 149afe34e3999c9e3c00760a74571fba9207c0ec9589ac1fcb1c66e9b347877f

AgentTesla

Executable exe a4e65fda279dd5b0cf9a1f8c23ce34b9b202b854616d54dfbf03737743c1bcd4

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 149afe34e3999c9e3c00760a74571fba9207c0ec9589ac1fcb1c66e9b347877f
Cape
Cape
https://www.capesandbox.com/analysis/356377/
  
Dropped by
MD5 88261f69b272391d719ee22b968a70c6

Comments