MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b607d204b9850b18b8174c1124fa960a5d204572b6a78e9558589189eb71dd32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 18


Intelligence 18 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b607d204b9850b18b8174c1124fa960a5d204572b6a78e9558589189eb71dd32
SHA3-384 hash: 4737ce8a3c2f967aa2397104b4b96233db458575b351e79a4fd95b53a322b848dde4e65aeef727b8dcd0e2f98f09826c
SHA1 hash: ab70f171b3b3bb605dff398e2f9ccae513a9a5e5
MD5 hash: 33e32535892e927ef60aac04bee483e6
humanhash: fix-pizza-equal-july
File name:07.11.2023 Hesap Ozeti.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:693'760 bytes
First seen:2023-11-10 06:26:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'795 x AgentTesla, 19'693 x Formbook, 12'274 x SnakeKeylogger)
ssdeep 12288:9WukVc1EjOyWWDxhuoNBZ2UBA7Wzie5lYYj7BK1VGPl8:8uk+KOyJiABEAA7WzT/d7B8Q+
Threatray 999 similar samples on MalwareBazaar
TLSH T1BFE401407A6CCB9BF6B953F336607200173AFAAB7925E24D9CDA21DA5537F008D52327
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon c018f9ccccf430c4 (16 x AgentTesla, 4 x Formbook)
Reporter abuse_ch
Tags:AgentTesla exe geo TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
288
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
07.11.2023 Hesap Ozeti.exe
Verdict:
Malicious activity
Analysis date:
2023-11-10 06:34:47 UTC
Tags:
stealer agenttesla
Link:
https://app.any.run/tasks/13bfaa20-12de-4f6b-b219-a4765ce684b0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Inject4.59820.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
macros-on-open packed
Link:
https://www.filescan.io/uploads/654dcd39993fbf888b6d9bbd/reports/c8caf344-d9b1-4732-8ecf-1201373c97b3/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/b607d204b9850b18b8174c1124fa960a5d204572b6a78e9558589189eb71dd32
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b23a84d3-b01d-417b-aefd-eefe13dc00fc
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1340283
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1340283 Sample: 07.11.2023_Hesap_Ozeti.exe Startdate: 10/11/2023 Architecture: WINDOWS Score: 100 40 mail.ardsmmm.com 2->40 42 mx.ardsmmm.com 2->42 46 Found malware configuration 2->46 48 Sigma detected: Scheduled temp file as task from temp location 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 5 other signatures 2->52 8 07.11.2023_Hesap_Ozeti.exe 7 2->8         started        12 wxvzPpxRj.exe 5 2->12         started        signatures3 process4 file5 36 C:\Users\user\AppData\Roaming\wxvzPpxRj.exe, PE32 8->36 dropped 38 C:\Users\user\AppData\Local\...\tmpE59A.tmp, XML 8->38 dropped 54 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->54 56 Uses schtasks.exe or at.exe to add and modify task schedules 8->56 58 Adds a directory exclusion to Windows Defender 8->58 14 07.11.2023_Hesap_Ozeti.exe 2 8->14         started        18 powershell.exe 23 8->18         started        20 powershell.exe 23 8->20         started        22 schtasks.exe 1 8->22         started        60 Multi AV Scanner detection for dropped file 12->60 62 Injects a PE file into a foreign processes 12->62 24 wxvzPpxRj.exe 12->24         started        26 schtasks.exe 12->26         started        signatures6 process7 dnsIp8 44 mx.ardsmmm.com 185.111.247.38, 49707, 49710, 587 MUVHOSTTR Turkey 14->44 28 conhost.exe 18->28         started        30 conhost.exe 20->30         started        32 conhost.exe 22->32         started        64 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 24->64 66 Tries to steal Mail credentials (via file / registry access) 24->66 68 Tries to harvest and steal browser information (history, passwords, etc) 24->68 34 conhost.exe 26->34         started        signatures9 process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b607d204b9850b18b8174c1124fa960a5d204572b6a78e9558589189eb71dd32
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b607d204b9850b18b8174c1124fa960a5d204572b6a78e9558589189eb71dd32/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-11-10 06:27:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
26
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wyd5ebfzqufrroaxjqisj6uwbjosarlsw2ty5fkylciyt23r3uza._file
Verdict:
malicious
Label(s):
agenttesla_v4
Create hunting rule
Similar samples:
062ac11f6486fd09b8cb2bfae9697db722d2b3ceb0fcd4f92793eb0cb90c4295
AgentTesla
61349ecc644e0336020398d7e7c168401e0b32397bffd5531868a1f2394cf4a2
AgentTesla
6799ba146b9ff5bcb092d8d1e3295fcb990a8a3e9e6c4f46bbd1e2d4ec7e8c7d
AgentTesla
b3c539f1892df92d8313b17897779d16a13f3ebeac608fbcf66aafc633622bfc
AgentTesla
+ 989 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/231110-g7rn6aec47/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
02ec2a6271b234d0eff15d5451d121e30841590a3cedbcd3ea078da2ecee76de
MD5 hash:
a26ebd3e65f060ef02c70e0b588e74ce
SHA1 hash:
da3d8b0456ac0dbcaf4002169e1b3795fd6cc3ac
Detections:
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/2810e48d-aa87-422f-95cf-6e8f4502e03c/
Parent samples :
bb934c8c993b5a096efb22396b82147369fa8ef44fc2da09089e590881e8c60e
b607d204b9850b18b8174c1124fa960a5d204572b6a78e9558589189eb71dd32
SH256 hash:
d01f3dea3851602ba5a0586c60430d286adf6fcc7e17aab080601a66630606e5
MD5 hash:
579197d4f760148a9482d1ebde113259
SHA1 hash:
cf6924eb360c7e5a117323bebcb6ee02d2aec86d
Link:
https://www.unpac.me/results/2810e48d-aa87-422f-95cf-6e8f4502e03c/
SH256 hash:
492f4dd11a369ee24cef79b66628bcd04315f8f84757130fd5d8fe17c89c2665
MD5 hash:
0464de1843941ee1fb0d98484e9d834b
SHA1 hash:
af1142be70bd29cc2e17cad1022d9a334c086245
Link:
https://www.unpac.me/results/2810e48d-aa87-422f-95cf-6e8f4502e03c/
SH256 hash:
62757af7ce2dcfe188245dd26d85e233c2ded82311c600c7c8ec83c8c8a071b2
MD5 hash:
804cc8416b7db140f03d251ca3abbf00
SHA1 hash:
1a1160f7db639606a1046b555b08a43035aff960
Link:
https://www.unpac.me/results/2810e48d-aa87-422f-95cf-6e8f4502e03c/
SH256 hash:
b607d204b9850b18b8174c1124fa960a5d204572b6a78e9558589189eb71dd32
MD5 hash:
33e32535892e927ef60aac04bee483e6
SHA1 hash:
ab70f171b3b3bb605dff398e2f9ccae513a9a5e5
Link:
https://www.unpac.me/results/2810e48d-aa87-422f-95cf-6e8f4502e03c/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b607d204b985/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b607d204b9850b18b8174c1124fa960a5d204572b6a78e9558589189eb71dd32

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:AgentTeslaV4
Create hunting rule
Author:kevoreilly
Description:AgentTesla Payload
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe b607d204b9850b18b8174c1124fa960a5d204572b6a78e9558589189eb71dd32

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments