MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab1144d8fcde912bc3e50f59f24eeb6fc6fb37cb5c20f194e41075e1baadb261. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab1144d8fcde912bc3e50f59f24eeb6fc6fb37cb5c20f194e41075e1baadb261
SHA3-384 hash: d9e2d83984c0d160054fbcd984836153ca4afd69f59beb02bf23152116bb268c558a43f55d22563945e52f1c409b983e
SHA1 hash: d01b01bfdfd84ecc565e20a4d011f42cf95dd7ad
MD5 hash: 3f939f0815bd9191fec619eac27c9db7
humanhash: sad-fix-table-one
File name:MT103.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:820'736 bytes
First seen:2023-07-25 12:36:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:XCbniNS+bM5s388VyfzBJZvgP/kfLihQ3h0HsiRJhCd2nk5EL:Eik+bWssD7QmOIhGsoCd2
Threatray 5'224 similar samples on MalwareBazaar
TLSH T19505F721DE6B6646D0DB523392B36D0F42F1BD193664E9D93F89308836B5A0CFA53E31
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon acac0001000001a2 (15 x AgentTesla, 4 x SnakeKeylogger, 1 x Formbook)
Reporter TeamDreier
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
283
Origin country :
DK DK
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
MT103.exe
Verdict:
Malicious activity
Analysis date:
2023-07-25 12:39:26 UTC
Tags:
agenttesla stealer
Link:
https://app.any.run/tasks/a44702ed-225a-45a6-b0bd-68152f355b79

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/432165/
Detection(s):
SecuriteInfo.com.Variant.Barys.19141.26022.24878.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Launching a process
Creating a process with a hidden window
Gathering data
Verdict:
Malicious
Labled as:
Barys.Generic
Link:
https://www.hybrid-analysis.com/sample/ab1144d8fcde912bc3e50f59f24eeb6fc6fb37cb5c20f194e41075e1baadb261
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4782255a-af1f-476e-9799-680e68e03aa6
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1279135
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1279135 Sample: MT103.exe Startdate: 25/07/2023 Architecture: WINDOWS Score: 100 33 Snort IDS alert for network traffic 2->33 35 Found malware configuration 2->35 37 Sigma detected: Scheduled temp file as task from temp location 2->37 39 6 other signatures 2->39 7 MT103.exe 6 2->7         started        11 ssYxCUZAfpzLs.exe 2 2->11         started        process3 file4 21 C:\Users\user\AppData\...\ssYxCUZAfpzLs.exe, PE32 7->21 dropped 23 C:\Users\user\AppData\Local\...\tmpE533.tmp, XML 7->23 dropped 25 C:\Users\user\AppData\Local\...\MT103.exe.log, ASCII 7->25 dropped 41 Uses schtasks.exe or at.exe to add and modify task schedules 7->41 43 Writes to foreign memory regions 7->43 45 Injects a PE file into a foreign processes 7->45 13 RegSvcs.exe 15 2 7->13         started        17 schtasks.exe 1 7->17         started        47 Multi AV Scanner detection for dropped file 11->47 49 Machine Learning detection for dropped file 11->49 signatures5 process6 dnsIp7 27 webmail.ultra.aqfoam.com 103.6.198.192, 49684, 587 EXABYTES-AS-APExaBytesNetworkSdnBhdMY Malaysia 13->27 29 api4.ipify.org 104.237.62.211, 443, 49683 WEBNXUS United States 13->29 31 api.ipify.org 13->31 51 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->51 53 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 13->53 55 May check the online IP address of the machine 13->55 57 2 other signatures 13->57 19 conhost.exe 17->19         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab1144d8fcde912bc3e50f59f24eeb6fc6fb37cb5c20f194e41075e1baadb261/
Threat name:
ByteCode-MSIL.Spyware.Kryptikagen
Create hunting rule
Status:
Malicious
First seen:
2023-07-25 05:51:30 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
21 of 23 (91.30%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vmiujwh432isxq7fb5m7etxln7dpwn6llqqpdfhecb26dovnwjqq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0ef8f46933f6388ca0374cda300f534802a54343ecade5f00d9cf2f9a6485638
AgentTesla
245ae7e9aa212853d61dcb445f5e1e1f11ca9a5f9d1d12f5bb54559768a39539
AgentTesla
3999ae85e06577c12f54b2b716c659836945aa0ca246af9607d27a756f44d194
AgentTesla
45a0278d1d4f0f08cef74a0cbfd450120b5677fd0bf53af0174074af957cee00
AgentTesla
45f47c94a6941a53e10edf8021e157d3eb74d6dc04559057b522cc9cbe30651e
AgentTesla
88c0c93c2fd81084ffae61e7813819c8a782c98376d2c4514c18a4ac1553cae1
AgentTesla
9605975e8a60b03447b1b508f4fa2c0640ff6662481b622b8db8060302b01fd1
AgentTesla
abe4e9779d399b488d7faf17febacdec241eda6ea49ee4f2c2f707876f4737d7
AgentTesla
ae1d10a430aed6814f985efb49cca0a27402e8c32653a7864a48b706c4f9a03b
AgentTesla
f468e71c51b81601ee1c836199470b669e9c5dd83d931890b406dc82744bdd1a
AgentTesla
+ 5'214 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection
Link:
https://tria.ge/reports/230725-ptgk2ace24/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Unpacked files
SH256 hash:
705dfca3891284a8b0a7299eb5495a9a60388ea51946552a973643b3bedb9037
MD5 hash:
0b19b2a2fba6b8e6268a8ae1b6dc58be
SHA1 hash:
f5db50d41333642d40adddf36b468abcfaec0ea0
Link:
https://www.unpac.me/results/324df373-3b9a-4275-9aae-248200bfa25b/
SH256 hash:
ea1618640feac639cbf8f6ee060cdd7dffeecdb11352e33c50a066dbf80fa650
MD5 hash:
223c52f75cccd4986bd4fa963a2e3ce2
SHA1 hash:
f134bcd3daf93c06ab205fe5df891ec1e52baa86
Link:
https://www.unpac.me/results/324df373-3b9a-4275-9aae-248200bfa25b/
SH256 hash:
0a562c1f9c2fb6ed50f92a1b18827175c8233ef31da92a3070fc38cc5147f3b6
MD5 hash:
7004e7499403c71e8b066d0cfc371241
SHA1 hash:
eaed80e45b90b7876e13e47516f3cf2cd7184fa2
Detections:
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/324df373-3b9a-4275-9aae-248200bfa25b/
Parent samples :
ab1144d8fcde912bc3e50f59f24eeb6fc6fb37cb5c20f194e41075e1baadb261
dafe0df547619cf487f3f4e3a0ef2fb26bddb5e70a69086aa74b52ce9f6fe519
eaa66b68fa6bac50239987cbdddad7ccae1924c807bf1fa528d11ebdb51f3929
9f9dd91a9d7373e39a8e7adc7e7ff1adba045e4590798eaf47f2a701e8036331
e146c10d13f2ed30acbf8733bf5b3ae1e75572fd917d8b6749b69c54676e9923
b4897fb2b7450804ea184f77c7661b1af8c022c294d69f127e8c1ee47f37ca68
b93fab56242eb11d31992191aa2a57f93c8f9b77d1041b4c97e830f2b4ff5045
0eb8bbeb7db95d53ff488d6177e646ad9d461e96d5cca5115e332d08352f4b15
SH256 hash:
a7e471f7bc560488312d57e885bb4cfc423587a0d84abbb3073a820f7cd0e209
MD5 hash:
e7709a907be0cdb6ff7eb99daee97c6c
SHA1 hash:
bb3f6871c40f54070b53947bf6958d410ea8bac1
Link:
https://www.unpac.me/results/324df373-3b9a-4275-9aae-248200bfa25b/
SH256 hash:
ab1144d8fcde912bc3e50f59f24eeb6fc6fb37cb5c20f194e41075e1baadb261
MD5 hash:
3f939f0815bd9191fec619eac27c9db7
SHA1 hash:
d01b01bfdfd84ecc565e20a4d011f42cf95dd7ad
Link:
https://www.unpac.me/results/324df373-3b9a-4275-9aae-248200bfa25b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ab1144d8fcde/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/ab1144d8fcde912bc3e50f59f24eeb6fc6fb37cb5c20f194e41075e1baadb261

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe ab1144d8fcde912bc3e50f59f24eeb6fc6fb37cb5c20f194e41075e1baadb261

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/432165/

Comments