MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b93fab56242eb11d31992191aa2a57f93c8f9b77d1041b4c97e830f2b4ff5045. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b93fab56242eb11d31992191aa2a57f93c8f9b77d1041b4c97e830f2b4ff5045
SHA3-384 hash: c374b1ef28c6eeb3e660d23a464a9d3e2ea9b4bf7f79e9e07093495d27e3d8f0d0852fef40ff9ac973d7865574812cca
SHA1 hash: 3dca6e9ed78d29572b38736dbb30d45c83927ad4
MD5 hash: a03f2b10ef2da9953911bb3468e9502e
humanhash: texas-early-texas-twenty
File name:transfer slip.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:848'896 bytes
First seen:2023-10-10 06:34:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:ABzX9KV1dWI5qsZeiXcshY2hLjuDfuOfb1sJv2iitU4EMMfm9e6Nz:otiq2dMQhLjHOZ4vQtUheIQz
Threatray 80 similar samples on MalwareBazaar
TLSH T163059A0CA5844612CE4822758412C7740EEA7C17A5E7E64F279F39EAEF72EB6D03117E
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f0cce260b1a6dcf0 (4 x AgentTesla, 2 x SnakeKeylogger)
Reporter TeamDreier
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
285
Origin country :
DK DK
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
transfer slip.exe
Verdict:
Malicious activity
Analysis date:
2023-10-10 07:18:55 UTC
Tags:
agenttesla stealer
Link:
https://app.any.run/tasks/4a07ef0e-9e8b-4a79-9417-d0ff27ab3f9b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/452794/
Detection(s):
SecuriteInfo.com.Win32.RATX-gen.8128.29067.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Launching a process
Restart of the analyzed sample
Searching for the window
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6524f09de509ddb6cd1f1276/reports/3dd5238e-28ae-48b1-bcfb-5622da3c3d12/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b93fab56242eb11d31992191aa2a57f93c8f9b77d1041b4c97e830f2b4ff5045
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1fff920a-f21a-49f2-8be0-acde340cf7c0
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1322599
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1322599 Sample: transfer_slip.exe Startdate: 10/10/2023 Architecture: WINDOWS Score: 100 42 webmail.ultra.aqfoam.com 2->42 44 api4.ipify.org 2->44 46 api.ipify.org 2->46 52 Snort IDS alert for network traffic 2->52 54 Found malware configuration 2->54 56 Antivirus / Scanner detection for submitted sample 2->56 58 9 other signatures 2->58 8 transfer_slip.exe 7 2->8         started        12 nFgmnRvHc.exe 5 2->12         started        signatures3 process4 file5 38 C:\Users\user\AppData\Roaming\nFgmnRvHc.exe, PE32 8->38 dropped 40 C:\Users\user\AppData\Local\...\tmp2831.tmp, XML 8->40 dropped 60 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->60 62 Uses schtasks.exe or at.exe to add and modify task schedules 8->62 64 Adds a directory exclusion to Windows Defender 8->64 66 Injects a PE file into a foreign processes 8->66 14 transfer_slip.exe 15 2 8->14         started        18 powershell.exe 23 8->18         started        20 powershell.exe 22 8->20         started        22 schtasks.exe 1 8->22         started        68 Antivirus detection for dropped file 12->68 70 Multi AV Scanner detection for dropped file 12->70 72 Machine Learning detection for dropped file 12->72 24 nFgmnRvHc.exe 12->24         started        26 schtasks.exe 12->26         started        28 nFgmnRvHc.exe 12->28         started        signatures6 process7 dnsIp8 48 webmail.ultra.aqfoam.com 103.6.198.192, 49712, 49715, 587 EXABYTES-AS-APExaBytesNetworkSdnBhdMY Malaysia 14->48 50 api4.ipify.org 173.231.16.77, 443, 49711, 49713 WEBNXUS United States 14->50 30 conhost.exe 18->30         started        32 conhost.exe 20->32         started        34 conhost.exe 22->34         started        74 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 24->74 76 Tries to steal Mail credentials (via file / registry access) 24->76 78 Tries to harvest and steal browser information (history, passwords, etc) 24->78 36 conhost.exe 26->36         started        signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b93fab56242eb11d31992191aa2a57f93c8f9b77d1041b4c97e830f2b4ff5045/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-10-10 02:48:29 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
18 of 36 (50.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xe72wvref2yr2mmzegi2uksx7e6i7g3x2ecbwtex5aypfnh7kbcq._file
Verdict:
malicious
Similar samples:
40d0a5c663f59b7454e4e8535918b57ccba56e5f445d02e384debb16b868ebce
AgentTesla
78091d62251b24e840b99cf80f6f9f68a1725a1b2cc3a11aee84847e59b38ff6
AgentTesla
b4897fb2b7450804ea184f77c7661b1af8c022c294d69f127e8c1ee47f37ca68
AgentTesla
b4e8e8b4c73c99ec54704c991759dc5e88c8623a487614ca6461ac6e4719f4d3
AgentTesla
cb371580851e963cfe4db1fa1953269d0c87acaaed578dd9fe670bc7a9d0df45
AgentTesla
d2fd1949ff48a2386bee257e09cbf97c6cdee8da93545c4d08aa43af0366eb2b
AgentTesla
dea0f4b762f8be8c3f654867cf7832e0ebaeda1c4ebcae17f5841743d3dc217f
AgentTesla
dfbecad8d36fe0dcdcb4d403209d8762fd4507e14674fabef306e28a5ede518b
AgentTesla
e146c10d13f2ed30acbf8733bf5b3ae1e75572fd917d8b6749b69c54676e9923
AgentTesla
+ 70 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/231010-hcb6nabf21/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
a040efb5ce92995b5d40fd2536c8ad6a93f2d8584a3dd52f07cdb0b34c9e6e29
MD5 hash:
a5a52675690de850e3de6c05a9bd885f
SHA1 hash:
fd953edf2e910fbb43c9e6d4c8d48632bb4e55c6
Link:
https://www.unpac.me/results/c446eb01-7533-409e-9f2a-258c47b0caec/
SH256 hash:
0a562c1f9c2fb6ed50f92a1b18827175c8233ef31da92a3070fc38cc5147f3b6
MD5 hash:
7004e7499403c71e8b066d0cfc371241
SHA1 hash:
eaed80e45b90b7876e13e47516f3cf2cd7184fa2
Detections:
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/c446eb01-7533-409e-9f2a-258c47b0caec/
Parent samples :
ab1144d8fcde912bc3e50f59f24eeb6fc6fb37cb5c20f194e41075e1baadb261
dafe0df547619cf487f3f4e3a0ef2fb26bddb5e70a69086aa74b52ce9f6fe519
eaa66b68fa6bac50239987cbdddad7ccae1924c807bf1fa528d11ebdb51f3929
9f9dd91a9d7373e39a8e7adc7e7ff1adba045e4590798eaf47f2a701e8036331
e146c10d13f2ed30acbf8733bf5b3ae1e75572fd917d8b6749b69c54676e9923
b4897fb2b7450804ea184f77c7661b1af8c022c294d69f127e8c1ee47f37ca68
b93fab56242eb11d31992191aa2a57f93c8f9b77d1041b4c97e830f2b4ff5045
0eb8bbeb7db95d53ff488d6177e646ad9d461e96d5cca5115e332d08352f4b15
SH256 hash:
a709689ea8fa1584da6d4162bc30fc5fe0128ba8d6ccd48dded8a275a4c347b6
MD5 hash:
6324e0b5a809723bd36638cd0d68c256
SHA1 hash:
d06a44df48b6582022f29e5dd5d5a3cf4eb8c020
Link:
https://www.unpac.me/results/c446eb01-7533-409e-9f2a-258c47b0caec/
SH256 hash:
d511c0658340ec9d35d8f08fd22ae55c6aeebcb52dac453040817a6f9ffd7e43
MD5 hash:
3ac67cb9041168e636198401f53d857b
SHA1 hash:
6207398f41db994130c80150a0c2598045e68b45
Link:
https://www.unpac.me/results/c446eb01-7533-409e-9f2a-258c47b0caec/
SH256 hash:
b93fab56242eb11d31992191aa2a57f93c8f9b77d1041b4c97e830f2b4ff5045
MD5 hash:
a03f2b10ef2da9953911bb3468e9502e
SHA1 hash:
3dca6e9ed78d29572b38736dbb30d45c83927ad4
Link:
https://www.unpac.me/results/c446eb01-7533-409e-9f2a-258c47b0caec/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b93fab56242e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b93fab56242eb11d31992191aa2a57f93c8f9b77d1041b4c97e830f2b4ff5045

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe b93fab56242eb11d31992191aa2a57f93c8f9b77d1041b4c97e830f2b4ff5045

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/452794/

Comments