MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b745c55dcbb76da839148d313128782133241865b2ad7c0da457d54134c65c84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 18

Intelligence 18 IOCs YARA 8 File information Comments

SHA256 hash:	b745c55dcbb76da839148d313128782133241865b2ad7c0da457d54134c65c84
SHA3-384 hash:	9eb1046fb2f747327fae04df43a8f69bbe3d392d2b5350e7073c84efb53504f2bc49104a0adaa9f9580d91fb0e80c6a1
SHA1 hash:	537407129743fc7ee3077063e7214c2320ae4cc6
MD5 hash:	32a64e4838a8f620ff3b3573cc76777c
humanhash:	stairway-speaker-alpha-fourteen
File name:	New Order.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	307'727 bytes
First seen:	2023-07-13 06:26:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep	6144:vYa62geEDkHJZ2ERbzxL4WAXhIsCFC8GvmFFs7EpJHZ4atHBDR/rnpyJWaW:vYg+DovvRPxL4WJFZCmb02JHacfbpy7W
Threatray	4'839 similar samples on MalwareBazaar
TLSH	T13664121959E1D1A7F2A1877188FAE361AFF3E612A038D35B430017953DB3697E6087B3
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

268

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

New Order.exe

Verdict:

Malicious activity

Analysis date:

2023-07-13 06:28:07 UTC

Tags:

stealer agenttesla

Link:

https://app.any.run/tasks/3e9988a8-da3a-43ac-a473-c773cbfb2d46

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/417246/

Detection(s):

SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.2011.30463.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Creating a file

Unauthorized injection to a recently created process

Restart of the analyzed sample

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Reading critical registry keys

Sending an HTTP GET request

Setting a keyboard event handler

Stealing user critical data

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/97379/overview

Behaviour

MalwareBazaar

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

control lolbin masquerade overlay packed shell32

Link:

https://www.filescan.io/uploads/64af993b6e9f7019dea00c31/reports/4e1c651c-e63f-4f55-8186-98d24a64e15f/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/b745c55dcbb76da839148d313128782133241865b2ad7c0da457d54134c65c84

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ea0d324c-e51d-48b2-80e1-dd61bf2b4065

Result

Threat name:

AgentTesla, NSISDropper

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1272218

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Machine Learning detection for sample

Maps a DLL or memory area into another process

May check the online IP address of the machine

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected NSISDropper

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/b745c55dcbb76da839148d313128782133241865b2ad7c0da457d54134c65c84/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-07-12 21:32:38 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 37 (70.27%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w5c4kxolw5w2qoiuruytckdyeezsigdfwkwxydnek7kucngglsca._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

8b2a9586bcf26045ba196d4714d8c628feb5d8eed4604ff82c6e3625b67a9437

AgentTesla

9197cc85a9c5fc3d9463da236c1c96551a0e805bdfd2d3c133a479f9b2ae6d0a

AgentTesla

922a02ffd022784f01ade79f8737a955cd2bc5fcc358c51a1c3d325e1d29ebea

AgentTesla

b8affa2c64dd1a3661fd9ea46581ea09b733871562c2d080f2c81923e7275961

AgentTesla

ccc2705cc016a910af89b39b5beeca2885eedd714cca5ab153b416c201d0ea96

AgentTesla

cdef751e4e5097b1dbebf7b0a168995f39e09360a8dd45556e7c507e55401807

AgentTesla

d964a65d39458176447fdb930e03e6534c19dcc556abde4cb522fa2aeb8289e8

AgentTesla

ea26eb1a80e95557c32242dbfe0265e2b0c134da0a67e5aa6e5eb861238568c3

AgentTesla

+ 4'829 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230713-g7rn6age5w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

8f750fce65601013e892eb0e9b41c4c8bf8632e4f736f60336f58e5307698a31

MD5 hash:

90152cc83ca4c2261813b9ece9da7c35

SHA1 hash:

b375a374639f88aca1b35ca4bab85049ba55b0ab

Link:

https://www.unpac.me/results/5fff88ac-c769-43c8-8ac1-61b993cd3aec/

SH256 hash:

e6d5de26b60438f6286331b0fd3ff64b9368048d144255db589736da99de7523

MD5 hash:

e2e90cdf7317a586a23a8ef6d262e9db

SHA1 hash:

7fe0251561ea267b4929fd17325d7c33bf6e3293

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/5fff88ac-c769-43c8-8ac1-61b993cd3aec/

Parent samples :

b745c55dcbb76da839148d313128782133241865b2ad7c0da457d54134c65c84
339429d967f98ad9c386cb00ba35eb536e2d6d724264ce454a8a1a350e0f40c4
33aceb5e578d09db43e7252164f9e231e9a54bf56635b959bc0ffd77b3a31c8b
46fd0f7f7fd95194e564c22a784298d2683637e410015fa344df29f3d8051d24
d3c740183caf8efc711c6955c884c3bc5d560796b1e1bf6a0a44696340710750
e9b265ef236137a61a9e6dfd209aab64d9e16543927f162490b00bbb10b043a7
8a8b2c88b95ccfad7225240dda7ad984f068987500ccfe2cadcab357f0fe46ab
6caed3fe67e7752a452ba5b09bfd37255ad9c1f6f3a7a752958b78d3e26fdd27
849370c7356134ab3a03a3c6217ef37ec0604a04d2df693ee91b0c5b3dbb01c7
fdbfeb2c04faf3de71e77af97d73ba3dd6aad08e783c785eb0a0fd831bd4b757
5ce651ac4d414f62033562a147cd6e7e821c408f50240ac3cd7c14fe89aaa108
43709291b4fd1aad625bdd7e8cc7d816aa49290412338b0cb79c093ac9a76609
5492a2e8a3516bb11e940265f77042f9a2fefdb282f54665b46aff69b6fa22f4
e6d5de26b60438f6286331b0fd3ff64b9368048d144255db589736da99de7523
700e76e7520021aeb60b4cd42c3ab8bbd2a20fc36228ad4dfce94c927b6e7f58
7cba6ce993da55a8706e4c726e120ce59a40622f20ed4f0beb971c1fb03b9519
93c6d96d2c4eff6927c67389dbfa6be605fb70f8005783c3b9915a1ed9fd47f9
ba5b23fdbec77442d3d5e9e87ea46dba8ce7df395fa5668edabe9be96eebae10
ce18daad377673d765ae77224400740842cc31aee43a2cdb5e5ac564fbbe908d

SH256 hash:

b62b93dafe51bb7b40a4f005c7c8d2863eda6495fc21897c3501a703fa91f18a

MD5 hash:

6dd8dc4b9584830f012fcabf9d9fb196

SHA1 hash:

70b6c19b7239b8195ee62d308ea6a4adb91c902d

Link:

https://www.unpac.me/results/5fff88ac-c769-43c8-8ac1-61b993cd3aec/

SH256 hash:

b745c55dcbb76da839148d313128782133241865b2ad7c0da457d54134c65c84

MD5 hash:

32a64e4838a8f620ff3b3573cc76777c

SHA1 hash:

537407129743fc7ee3077063e7214c2320ae4cc6

Link:

https://www.unpac.me/results/5fff88ac-c769-43c8-8ac1-61b993cd3aec/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b745c55dcbb76da839148d313128782133241865b2ad7c0da457d54134c65c84

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV4 Create hunting rule
Author:	Rony (r0ny_123)

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	MSIL_SUSP_OBFUSC_XorStringsNet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:	https://github.com/dr4k0nia/yara-rules

Rule name:	msil_susp_obf_xorstringsnet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it

Rule name:	pe_imphash Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 164d26cb2c6ec9cff85867d22497870c7aa8d2af5aa0297c37da33dcaabcf5ab

AgentTesla

exe b745c55dcbb76da839148d313128782133241865b2ad7c0da457d54134c65c84

(this sample)

Delivery method

Other

Dropped by

SHA256 164d26cb2c6ec9cff85867d22497870c7aa8d2af5aa0297c37da33dcaabcf5ab

Cape

https://www.capesandbox.com/analysis/417246/

Dropped by

MD5 0510ae59a969bf952aae38b618a76ac8

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample