MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7d8fbbf428d72bcf7513bf41bfbf43db9f8f90a86f790b35e439dc1c1ac58e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 12

Intelligence 12 IOCs YARA 2 File information Comments 1

SHA256 hash:	b7d8fbbf428d72bcf7513bf41bfbf43db9f8f90a86f790b35e439dc1c1ac58e0
SHA3-384 hash:	c425cca4386ae9ac18961363cf3d60c0813dbb005598499be019835474de203351bea4b186ff0cf6ac0c58dc5357032c
SHA1 hash:	958c34671e00dad345d06738845db6c019e7be31
MD5 hash:	0a937838141cf6acfb3d63ae2b4673b3
humanhash:	colorado-equal-timing-mountain
File name:	0a937838141cf6acfb3d63ae2b4673b3
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'084'928 bytes
First seen:	2023-03-17 17:53:16 UTC
Last seen:	2023-03-21 13:56:22 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep	24576:n8Gcfl+LHXD5jkj+DM4G2hrLfAyZrA+np3zcIibp3:niQjk34GKr8iAKVi13
Threatray	1'719 similar samples on MalwareBazaar
TLSH	T129359D9C7610B5EEC817CD76C9B82C64EA6224BB830BD243905B15EDDA0EA97DF141F3
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	f0c4f4c4dcdcdcf8 (8 x AgentTesla, 6 x SnakeKeylogger, 2 x Formbook)
Reporter	zbetcheckin
Tags:	32 AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

232

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Exploit.MathType-Obfs.Gen.12640.22160

Verdict:

Malicious activity

Analysis date:

2023-03-17 16:28:38 UTC

Tags:

exploit cve-2017-11882 loader

Link:

https://app.any.run/tasks/f0f5990f-18c5-41a0-85bc-6330ef455da7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/375196/

Detection(s):

Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL

SecuriteInfo.com.Heur.15352.28720.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Launching a process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6414a93dc60b3295f52b9705/reports/46c82b4d-46cd-4f47-a7a8-3785415b0c68/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/b7d8fbbf428d72bcf7513bf41bfbf43db9f8f90a86f790b35e439dc1c1ac58e0

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/62c4f066-b984-49c5-9173-82c728815a0d

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1196123

Signature

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected AgentTesla

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b7d8fbbf428d72bcf7513bf41bfbf43db9f8f90a86f790b35e439dc1c1ac58e0/

Threat name:

ByteCode-MSIL.Trojan.CrypterX

Status:

Malicious

First seen:

2023-03-17 17:46:00 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

19 of 39 (48.72%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w7mpxp2crvzlz52rhp2bx67uhw47r6ikq33zbm26ioo4dqnmldqa._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

07a41eff76914977afbfe4bf07f2ef55d2478dd32a439c3979f619679c7a69b3

AgentTesla

4b3b2e33768b07e48c7b2a32ec2e0f0fcd94b2062170b975f5324d77d28105a2

AgentTesla

51a4fb3b2148da43d34a86a9af619af67ff8611f8bb7448e4edcb9d3207ca1b2

AgentTesla

96e6b35af2596dc6f5f0b48d49d46cba147ece46616be5aa59e74f18ef3554e0

AgentTesla

9f7bc16e3e1f2dd542f8de4d732c19b89e54a7e0924b36274f087aa329359767

AgentTesla

d37ac5f67be37a7cd0fa09b2d0ffb1e5190caf1abbb2183fd00b0c7a35a204b1

AgentTesla

d3cde2174f9799d957210cd054bee35f092e5480bb7019ca10e7b7f5abb116bf

AgentTesla

d9ffc57c4f2b13e4623b8de5ff380625f9ad65a62c80e5fb91be0db6861e5992

AgentTesla

fc8c6d3dafa922ac0493c26e96e337563b1beaa46e1725ed1799ac5a46ceabcd

AgentTesla

+ 1'709 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230317-wgv18abd8x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AgentTesla

Malware Config

C2 Extraction:

https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/

Unpacked files

SH256 hash:

0da41e8a9eab4711332680c7ddc115c8f900606978ad1074c405229c91be101b

MD5 hash:

c8f0ca5137b35c3143eef69ab2932305

SHA1 hash:

d68f5a47b77b66571b6ccc2eb80afb2f9e658866

Link:

https://www.unpac.me/results/6b42977f-c186-4373-82bd-4f2d44a7c794/

SH256 hash:

8b6897340984e35dba937364681bd98592594774504daf0a724c843c00b95341

MD5 hash:

3a566b5e883a0c0cdfe09cd5d64bce6f

SHA1 hash:

9cbdec781d7aabbe6286474833877aa6ca030951

Link:

https://www.unpac.me/results/6b42977f-c186-4373-82bd-4f2d44a7c794/

Parent samples :

02e5efb34c7a49fdfa2aa6e1399060c94f2de759c15040aaea1499062a3f9901
2463a1d5e35dde5253c9706b07f3eef1166488a56437dc94c816a269770f8073
00b4678b94d884d5638bd270ed0c42f20697ebb1ba2746d14b45515da43bd3b7
1eff050baff83ae24c33483e5d79a58d2ca3370b8716332ac88c1c704338c3b1
bebd0c5009a5b0b0a06fbe0020bd6f083ed90509771dbf1f8010e19e527bf464
b63331b6052cd2cdecf84fd9a481bc30a5c8404d09a5694700a6b79f5d76514a
1ce24db77fddb5022011d0407f93d6217b84ad6e18bf9be127bd8d2808423b73
8eb1f5551a27d2fe1366393c4fc787ebf70dd0d394e1d229bd8a5ba34f418bb3
da59dd1b2e20e25f770267c503b455d48c710a285721f78ab1a8070200d67261
7e2c9879e89b79edbda3e04321d02030f94543d6766fc4a4474df65537bbac75
801b442b0666a9911fdbd15b4ef325314af7b9459c10da89a4568088cc1a9ee2

SH256 hash:

b868e820fa5f6c5c60d37f50f05ce3d17914767443ffe59bcde6425625f3b0a9

MD5 hash:

957beaab633b18c26ba425f4ef31833a

SHA1 hash:

537eb981a790377e6c64d07f52e5272c7ee74a55

Link:

https://www.unpac.me/results/6b42977f-c186-4373-82bd-4f2d44a7c794/

SH256 hash:

e19265b1f06cd4ce35c52e3b1cbbffbc15c5687e6414e2e6d880fa77c4720504

MD5 hash:

7867430c6afc4be4ba2b8c9cb58bf7c2

SHA1 hash:

190016271c123236b9eeb06060247f59a586b1e4

Link:

https://www.unpac.me/results/6b42977f-c186-4373-82bd-4f2d44a7c794/

SH256 hash:

8f0c7e3047346b8d6477ff6d4639fd6157602c7ebc840f3432b99263f1cb415c

MD5 hash:

e5b073b30db1b058298f5df032164e4d

SHA1 hash:

15d3ada4e7ac01b766615b9b66785e7e2ae9b0ca

Link:

https://www.unpac.me/results/6b42977f-c186-4373-82bd-4f2d44a7c794/

SH256 hash:

b7d8fbbf428d72bcf7513bf41bfbf43db9f8f90a86f790b35e439dc1c1ac58e0

MD5 hash:

0a937838141cf6acfb3d63ae2b4673b3

SHA1 hash:

958c34671e00dad345d06738845db6c019e7be31

Link:

https://www.unpac.me/results/6b42977f-c186-4373-82bd-4f2d44a7c794/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b7d8fbbf428d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b7d8fbbf428d72bcf7513bf41bfbf43db9f8f90a86f790b35e439dc1c1ac58e0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

exe b7d8fbbf428d72bcf7513bf41bfbf43db9f8f90a86f790b35e439dc1c1ac58e0

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2575282/

Cape

https://www.capesandbox.com/analysis/375196/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-03-17 17:53:24 UTC

url : hxxp://192.3.223.30/eazy.exe