MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b0d7ddfe5bafd689ce3cca8c56cabe4f0ff4251f30ba4420e274f8c57e6168ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 11
| SHA256 hash: | b0d7ddfe5bafd689ce3cca8c56cabe4f0ff4251f30ba4420e274f8c57e6168ef |
|---|---|
| SHA3-384 hash: | d9748bee8800963d720c70f95b71ef4ff046ba5294dcb772a5ac1b3d714ac08a24c1971a63cacb0dd2e1f7a7ae04dbfb |
| SHA1 hash: | 99dcc736ee56103c7d46e03f1f9b9b4300b57ed7 |
| MD5 hash: | 77700b2029865a9c9b92cb86cc71ac20 |
| humanhash: | violet-tango-dakota-diet |
| File name: | Tender notification_.03.23.2022.xlxs.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 1'105'920 bytes |
| First seen: | 2022-03-23 09:05:08 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:gbEzZ7moids5yOi71qFk+bDxO6ybfqqUuBO7Dvpyot:iO0o+sdi71q++fM+uGDh |
| Threatray | 15'114 similar samples on MalwareBazaar |
| TLSH | T1603523CC73C80712C1FE07FA488051505BB3793B2660DBAE5C96B4CA6D73B519E52EAB |
| File icon (PE): |  |
| dhash icon | 6264dcfefefefcc8 (12 x AgentTesla, 4 x SnakeKeylogger, 3 x NanoCore) |
| Reporter |  lowmal3 |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Tender notification_.03.23.2022.xlxs.exe
Verdict:
Malicious activity
Analysis date:
2022-03-23 03:19:04 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Detection:
agenttesla
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-03-23 11:02:54 UTC
AV detection:
19 of 26 (73.08%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 15'104 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla collection evasion keylogger spyware stealer trojan
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Maps connected drives based on registry
Checks BIOS information in registry
Checks computer location settings
Looks for VMWare Tools registry key
AgentTesla Payload
Looks for VirtualBox Guest Additions in registry
AgentTesla
Unpacked files
SH256 hash:
48fc3a7fdd2f37a7d2730eda1c69d0fff04cc54577e3d62d543b3cd7f8d6bc03
MD5 hash:
0891cb8c616e6397463e48b241bfe328
SHA1 hash:
fab3f204c8b92855b4af3e47a9782a3b674867a0
SH256 hash:
dc5c057b0ee1eb079cf189762aac69f0d86338ea18795dc4fbf7ed9b5a45c2eb
MD5 hash:
4103ed94f4747b30e166cf3c25416f47
SHA1 hash:
d553a67056e94f60d621ca42dcecd6d93f9ef1ad
SH256 hash:
2a87fc3934cd341dbd4437f0cc88fab61fb6b20916fffc9b8ccec68a2900baea
MD5 hash:
b99142a9c1a98fe5107c57da805d1023
SHA1 hash:
be470edce1c88da1dbd191c30183cc2c1500a039
SH256 hash:
b688ff1e56e6f78a82a80ed497c52d25eb833797d0a9bd604e76f73e36481a5d
MD5 hash:
873511dade94e448d826fa40c6772709
SHA1 hash:
7133217d69d18dfaa95ab7b41eeae550528ae5d2
SH256 hash:
b0d7ddfe5bafd689ce3cca8c56cabe4f0ff4251f30ba4420e274f8c57e6168ef
MD5 hash:
77700b2029865a9c9b92cb86cc71ac20
SHA1 hash:
99dcc736ee56103c7d46e03f1f9b9b4300b57ed7
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.