MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aadd267ebc7dde803f8d0486df95ad9eb6db7f1600fb7fcc0bbba70cd26bfcd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aadd267ebc7dde803f8d0486df95ad9eb6db7f1600fb7fcc0bbba70cd26bfcd2
SHA3-384 hash: 634a8a872e9b83b5aa5efa96118b27cf39b234414459f6dc1114ce4165b4877f3ff0713ee656e7cc773a59f607154d54
SHA1 hash: 6449461451d38ee4786c3c25721eba354456b684
MD5 hash: edbfe9219e5b53f41d49c61d42a83935
humanhash: pizza-floor-four-mirror
File name:aadd267ebc7dde803f8d0486df95ad9eb6db7f1600fb7fcc0bbba70cd26bfcd2
Download: download sample
Signature AgentTesla
Create hunting rule
File size:745'472 bytes
First seen:2023-04-03 13:11:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:f0tmYMUnFW/NobMbGWcSZ0nMMLjsjneNwfIttZvoERDSTnF42LrzrI:f0tU+zWHScKwCvRD6nF42Lrg
Threatray 2'150 similar samples on MalwareBazaar
TLSH T19FF402742FEA5235F8B62BBE90E43991977E63B32753C94D08B520C54B23B035AD193B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 209488c66eb85922 (14 x AgentTesla, 7 x Loki, 7 x Formbook)
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
242
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
aadd267ebc7dde803f8d0486df95ad9eb6db7f1600fb7fcc0bbba70cd26bfcd2
Verdict:
Malicious activity
Analysis date:
2023-04-03 13:11:31 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/136ec9b6-cd03-48ce-ad50-33d4bf0f2b23

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/379705/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Win.Trojan.EmbeddedDotNetBinary-9940868-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo formbook packed remcos
Link:
https://www.filescan.io/uploads/642ad0a5c56b2da73aca8636/reports/6e1863dc-7e3c-4e79-996b-b49a4d0e3516/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/aadd267ebc7dde803f8d0486df95ad9eb6db7f1600fb7fcc0bbba70cd26bfcd2
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ee582c3c-ab1c-4463-a9bf-f5bb0dd2a4b9
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1207061
Signature
.NET source code contains potential unpacker
Installs a global keyboard hook
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aadd267ebc7dde803f8d0486df95ad9eb6db7f1600fb7fcc0bbba70cd26bfcd2/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-03-20 03:42:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
22
AV detection:
19 of 23 (82.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vlosm7v4pxpiap4nasdn7fnnt23nw7ywad5x7talxotqzutl7tja._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
15852a249bf70514a6c961426ec261dff37d2a6bf8588d6f9775b8107a8c973f
AgentTesla
769d0e9720bbc74f76e295710fbc77d8cb3998353ca7084bc121e780c9b1f3ef
AgentTesla
a1e2e07c9b335493af4c7eb345f5e478d758efadb8ef2df597e08734c5ccffa1
AgentTesla
a6e90968f76ced3803d80c89af66fa1f76e6012b7a0a85a1ed53b71997537799
AgentTesla
c0d69c07096000d15184964499d68e91874da06fc8d461ae8b4bc376ea72fd30
AgentTesla
d03b8c0fcbbdc16e4c7d5794c037ad639ce4c55aa42fc1905c179c4213d0b04f
AgentTesla
d3cbeafcefe0aa050926d93155a7b57664103941038a9bbeecd67d9668083a12
AgentTesla
d6c81069f8763d1bb3ee317188270f97b60271b52ab35bd92080dde6913ad2e2
AgentTesla
e1332c9ff034ded7f31b405f082cba3f67c5bf23f679e08643907ff26679cbfb
AgentTesla
f95d3729e669fa3022b88892ec9d6b7b81d7bb4f9ea573660967dea575a55b2f
AgentTesla
+ 2'140 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230403-qfhfvaeh93/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
8c94dbbc9fa42cb45b8f6ba134df4ec28dd24c5dd93f80d286eff7552d073e11
MD5 hash:
895b9bc06dacb5097757497c4317ae0f
SHA1 hash:
c3f4579fca0325ac3189b6089eeb5d052df66701
Link:
https://www.unpac.me/results/f967a6ff-9981-4b57-b264-1117ba088c4f/
SH256 hash:
4c84a3f9b3c51d5857dd427b24794a7211f14a53660e539734a69b647d4edf6f
MD5 hash:
3708a766f42260a8bb1f94ba36d81ade
SHA1 hash:
9c591bafed8efe68118c657586f3d9aed7bef09e
Link:
https://www.unpac.me/results/f967a6ff-9981-4b57-b264-1117ba088c4f/
SH256 hash:
d06df7395d561e198f9b7c5481567116ff2e4c2e84437c018d2a2c8ea6c4ca37
MD5 hash:
0fb6061f7d37424fb9e6d0e76b019c19
SHA1 hash:
98a64bf7b459f032d6ec5793003bf61b5ae1dd74
Link:
https://www.unpac.me/results/f967a6ff-9981-4b57-b264-1117ba088c4f/
Parent samples :
495607b1aef01bf7dfb64b5cb16a8fc0f161c2923627d71c69de97328f8eca3f
2434aa78b46a3afc98fa6e888c3eb56278ba52b0ff800e7e875af9c2e7f9011a
SH256 hash:
6b5df0600b50956daf4444dd45ae0b31d5c268855b036cb756877645bb8b4b0f
MD5 hash:
488408a50393dd8f49b8aad9cd5872c4
SHA1 hash:
9624585f0de21427cbbe8676f648cd2ff87b9a37
Link:
https://www.unpac.me/results/f967a6ff-9981-4b57-b264-1117ba088c4f/
SH256 hash:
6d32c3566a8799637f4260dd3968a64e043bce3216d495a5352d48e0b93e3c1c
MD5 hash:
6d07ab69052754cc4b3f386d5bfdcf7f
SHA1 hash:
640abd76ffe7a37c0be8a9a24b38b6942525795a
Link:
https://www.unpac.me/results/f967a6ff-9981-4b57-b264-1117ba088c4f/
Parent samples :
09b46ee5dfe774f84ff6a056441f1a0e579a24970e5e61ab47b1e9885551b946
9f20125e93f217448a2a774a8470196dc28c401fdb2a2efb77455b392483eb9e
8782056d9091e507124a6a17d8b3063f8f5d9dee912c70bbaf3f7b62783d388d
e1096e70a136c8e8b4a1a54512f69abc0e0f042aacf5aa023a8f4b17ca8c8a6f
c426bd013529f036cb9b8e57b416629c8bec3622248d6ef0b171fa7ff7caaf33
SH256 hash:
aadd267ebc7dde803f8d0486df95ad9eb6db7f1600fb7fcc0bbba70cd26bfcd2
MD5 hash:
edbfe9219e5b53f41d49c61d42a83935
SHA1 hash:
6449461451d38ee4786c3c25721eba354456b684
Link:
https://www.unpac.me/results/f967a6ff-9981-4b57-b264-1117ba088c4f/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/aadd267ebc7d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aadd267ebc7dde803f8d0486df95ad9eb6db7f1600fb7fcc0bbba70cd26bfcd2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Suspicious_Macro_Presence
Create hunting rule
Author:Mehmet Ali Kerimoglu (CYB3RMX)
Description:This rule detects common malicious/suspicious implementations.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/379705/

Comments