MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b0d84d52f04c8ebd0f32b36034bcd094d5115db5c598b75bd534a802fb9a901d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 11
| SHA256 hash: | b0d84d52f04c8ebd0f32b36034bcd094d5115db5c598b75bd534a802fb9a901d |
|---|---|
| SHA3-384 hash: | f80ec374a3b7718d91c71f0835ecf7dbe54fc6d1fc6412b85670b159c04e0be0a4bec3a9ad9af7923077afd88677dca0 |
| SHA1 hash: | fa195ea7274c028dd398a611a67f9092b7498fd8 |
| MD5 hash: | f44f099f0f8c17a1f7ac134c81ca8cf0 |
| humanhash: | wisconsin-carpet-nitrogen-oregon |
| File name: | f44f099f0f8c17a1f7ac134c81ca8cf0 |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 884'736 bytes |
| First seen: | 2023-03-08 14:16:35 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 24576:8a/5u613OOV8QuRB91/4g/jtlkHDycAwRA2OU:ZFOO8/RBr/4EjbuDycA6AG |
| Threatray | 1'313 similar samples on MalwareBazaar |
| TLSH | T11615CF9972B25423FC8F41BA192BE69D2D7171433355E33B5B3B3AD1D2019BFB288642 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | 00f0f4f4eca43600 (5 x Loki, 5 x SnakeKeylogger, 5 x AgentTesla) |
| Reporter |  zbetcheckin |
| Tags: | 32 AgentTesla exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
223
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2023X03X02.xls
Verdict:
Malicious activity
Analysis date:
2023-03-08 11:49:18 UTC
Tags:
exploit cve-2017-11882 loader
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Unknown
Result
Threat name:
AgentTesla, zgRAT
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected zgRAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Backdoor.Androm
Status:
Malicious
First seen:
2023-03-08 13:06:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
14 of 25 (56.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 1'303 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
371c4cece4aa110d984113956243846298d2a9b2b191e0d7e75245d0758ae296
MD5 hash:
f258c9182ab69cd77a4f896e31edcced
SHA1 hash:
e67ca97035d6ba2a8219807db79904302f42a03f
SH256 hash:
d06df7395d561e198f9b7c5481567116ff2e4c2e84437c018d2a2c8ea6c4ca37
MD5 hash:
0fb6061f7d37424fb9e6d0e76b019c19
SHA1 hash:
98a64bf7b459f032d6ec5793003bf61b5ae1dd74
SH256 hash:
2de8a9e3d119a8b332a82e5bdefbb4b56d1162dce627e51fffcc307f0056a51b
MD5 hash:
3c3d2d4eeacacf647425fcf3864f2a05
SHA1 hash:
92e44b89c45e14011ed2ffac5ac19214a14aaf47
SH256 hash:
f0b5366d20a149871cad84b99f97505f5408ddc640b128661f618ad6a116b86a
MD5 hash:
9e0aba45c94f9f5646ffaf770114552f
SHA1 hash:
8f68a1013f5b3ef274004f69c24068fc9c1fac48
SH256 hash:
dd49948e0b3393a8b53084075ec2f2a8c36813d1ba1ca538697eb62ec4b4deae
MD5 hash:
538dab51e58b7dd3809664982f4d0746
SHA1 hash:
4e7f9615f1d96b087c453a72217662f867e0520d
SH256 hash:
b0d84d52f04c8ebd0f32b36034bcd094d5115db5c598b75bd534a802fb9a901d
MD5 hash:
f44f099f0f8c17a1f7ac134c81ca8cf0
SHA1 hash:
fa195ea7274c028dd398a611a67f9092b7498fd8
Malware family:
AgentTesla
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://192.3.194.46/olori.exe