🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ada26de90884fdf8d203297f5f5d2db98c411cebc7a8d36114f0b1ee2b413431. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ada26de90884fdf8d203297f5f5d2db98c411cebc7a8d36114f0b1ee2b413431
SHA3-384 hash: b9f5046fc4d25a6faac2a93e6b77734eb3907afc43d9d833b50478da74865d5de213a99901d329463fb74c57b0bd9261
SHA1 hash: 7fdcc0ff2d1a8100acbe2e4e0372734bb4396bc1
MD5 hash: 9b79cf9008f569169eba09528bf1730c
humanhash: alanine-bakerloo-uniform-steak
File name:Orden#46789_2024_Optoflux_mexico_sderls.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:927'744 bytes
First seen:2024-06-27 06:54:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'296 x AgentTesla, 20'714 x Formbook, 12'401 x SnakeKeylogger)
ssdeep 24576:nMm5SH6MIl3LkGDhsmD/U0haY/s9fXC7v:nMm5Lnl7kSUXYofXCj
Threatray 11 similar samples on MalwareBazaar
TLSH T1CD15BE9B73DC2B4CE1BD0BB43532213083B1EF83D961A64879C8EDED267664C69513DA
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon e2ee8a8eb6d8ecf4 (56 x AgentTesla, 40 x GuLoader, 40 x Formbook)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
348
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ada26de90884fdf8d203297f5f5d2db98c411cebc7a8d36114f0b1ee2b413431.exe
Verdict:
No threats detected
Analysis date:
2024-06-27 06:57:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8fdc3131-3667-4ad2-ba35-c58ef4dd4425

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Dropper.Nanocore-10025009-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=667d0cd4f2a3d25545469465win10vpnfull_triage
Tags:
Execution Generic Network Stealth Trojan Generickd
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Creating a window
Running batch commands
Launching a process
Creating a file
Creating a file in the %AppData% directory
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
evasive explorer formbook lolbin nanocore packed vbnet
Link:
https://www.filescan.io/uploads/667d0c8e6b8dba248b462705/reports/d79895e2-96c8-4102-8676-28286e0e7114/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/ada26de90884fdf8d203297f5f5d2db98c411cebc7a8d36114f0b1ee2b413431
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e35f9dc9-ec27-4224-8d8a-e4d50f74580a
Result
Threat name:
AgentTesla, DarkTortilla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1463465
Signature
AI detected suspicious sample
Allocates memory in foreign processes
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected DarkTortilla Crypter
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1463465 Sample: Orden#46789_2024_Optoflux_m... Startdate: 27/06/2024 Architecture: WINDOWS Score: 100 87 Found malware configuration 2->87 89 Malicious sample detected (through community Yara rule) 2->89 91 Multi AV Scanner detection for submitted file 2->91 93 7 other signatures 2->93 8 vexplorerez.exe 17 5 2->8         started        12 Orden#46789_2024_Optoflux_mexico_sderls.exe 14 3 2->12         started        15 chrome.exe 2->15         started        process3 dnsIp4 77 216.58.212.132 GOOGLEUS United States 8->77 121 Multi AV Scanner detection for dropped file 8->121 123 Machine Learning detection for dropped file 8->123 125 Writes to foreign memory regions 8->125 131 2 other signatures 8->131 17 InstallUtil.exe 8->17         started        21 InstallUtil.exe 8->21         started        23 Acrobat.exe 8->23         started        79 142.250.185.132 GOOGLEUS United States 12->79 63 Orden#46789_2024_O...xico_sderls.exe.log, ASCII 12->63 dropped 127 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 12->127 129 Hides that the sample has been downloaded from the Internet (zone.identifier) 12->129 25 cmd.exe 3 12->25         started        28 cmd.exe 1 12->28         started        81 192.168.2.11 unknown unknown 15->81 83 239.255.255.250 unknown Reserved 15->83 30 chrome.exe 15->30         started        file5 signatures6 process7 dnsIp8 65 208.95.112.1 TUT-ASUS United States 17->65 67 185.230.214.164 COMPUTERLINEComputerlineSchlierbachSwitzerlandCH Netherlands 17->67 95 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->95 97 Tries to steal Mail credentials (via file / registry access) 17->97 99 Tries to harvest and steal ftp login credentials 17->99 101 Tries to harvest and steal browser information (history, passwords, etc) 17->101 103 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->103 105 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 21->105 107 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 21->107 32 AcroCEF.exe 23->32         started        59 C:\Users\user\AppData\...\vexplorerez.exe, PE32 25->59 dropped 61 C:\Users\...\vexplorerez.exe:Zone.Identifier, ASCII 25->61 dropped 109 Uses ping.exe to sleep 25->109 34 vexplorerez.exe 3 25->34         started        37 conhost.exe 25->37         started        39 PING.EXE 1 25->39         started        41 PING.EXE 1 25->41         started        111 Uses ping.exe to check the status of other devices and networks 28->111 43 PING.EXE 1 28->43         started        46 conhost.exe 28->46         started        48 reg.exe 1 1 28->48         started        69 142.250.186.100 GOOGLEUS United States 30->69 71 1.1.1.1 CLOUDFLARENETUS Australia 30->71 73 2 other IPs or domains 30->73 file9 signatures10 process11 dnsIp12 50 AcroCEF.exe 32->50         started        113 Writes to foreign memory regions 34->113 115 Allocates memory in foreign processes 34->115 117 Hides that the sample has been downloaded from the Internet (zone.identifier) 34->117 119 Injects a PE file into a foreign processes 34->119 53 Acrobat.exe 34->53         started        55 InstallUtil.exe 34->55         started        57 InstallUtil.exe 34->57         started        85 127.0.0.1 unknown unknown 43->85 signatures13 process14 dnsIp15 75 23.41.168.139 ZAYO-6461US United States 50->75
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ada26de90884fdf8d203297f5f5d2db98c411cebc7a8d36114f0b1ee2b413431
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ada26de90884fdf8d203297f5f5d2db98c411cebc7a8d36114f0b1ee2b413431/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2024-06-10 19:48:59 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vwrg32iiqt67ruqdff7v6xjnxggechhly6ungyiu6cy64k2bgqyq._file
Verdict:
malicious
Similar samples:
08659ab007c7ef96258f0a84ff160d44ec2f74b594e1a128755beae8bc315900
AgentTesla
2847858d6dff7daa0e79508437025c0a1640f609ba9c4d8219edd4cf9e2fc276
AgentTesla
3e21e139da2602921d760b944c7d568f6d66cf7b5fee21cd506c3a1acc0da729
AgentTesla
70dc6b10fdd33612ca1ace7c466c80d314ce30f507b6eb6c0ac7ed4b4e8b0015
AgentTesla
afb9b832b61a4c5152e1747afaed615fdfb2d79d42c4bc683ade8c0de25cde8d
AgentTesla
ef256da3ed2681fc13f3de7f541f387da9f232731830faa6f7dcb5e1f4b98de2
AgentTesla
+ 1 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/240627-hn73gazeql/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Executes dropped EXE
Loads dropped DLL
AgentTesla
Unpacked files
SH256 hash:
2db82e9b91b1ccb1957b4e06ec49bfb0096e973213fc1786de1bbe3162f5df5a
MD5 hash:
27dea42a70bd7e948f1171ce873878a1
SHA1 hash:
b87051d51479c093cdf3e721acea4fd8b940b1e5
Link:
https://www.unpac.me/results/5e604ddd-7791-405e-b009-4fbdb1fe35d7/
Parent samples :
b5208e91338567d9c4d2011b40ce6763c0385f0f783f79ca5d992662958715c1
29c448bdc2c15ab16866756f1bcbda9219330bcb3a99c61bd0ddf45a2b4caf35
f230118d14a393bc3af4ff150e719f215a2fe7a024734de1c44ce12b987a7706
SH256 hash:
ada26de90884fdf8d203297f5f5d2db98c411cebc7a8d36114f0b1ee2b413431
MD5 hash:
9b79cf9008f569169eba09528bf1730c
SHA1 hash:
7fdcc0ff2d1a8100acbe2e4e0372734bb4396bc1
Link:
https://www.unpac.me/results/5e604ddd-7791-405e-b009-4fbdb1fe35d7/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ada26de90884/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ada26de90884fdf8d203297f5f5d2db98c411cebc7a8d36114f0b1ee2b413431

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments