MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9e042ace2e1ac33cfefd677bb466fe867ba7dbb277ba2716542b8601bda4a13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9e042ace2e1ac33cfefd677bb466fe867ba7dbb277ba2716542b8601bda4a13
SHA3-384 hash: 47ae94ec2096b7c5031c3558412aeb11018f455d2dcebe122c2aafd740816a7f0f9e5529138ce875584d2446ec68a724
SHA1 hash: a26253e9c30dd6e1baa5045db0d62af1556bc89b
MD5 hash: 5e6e62c7d0b755d3a5de09599c5c21b0
humanhash: comet-xray-mountain-island
File name:SecuriteInfo.com.Trojan.Packed2.45681.10659.5439
Download: download sample
Signature AgentTesla
Create hunting rule
File size:635'904 bytes
First seen:2023-10-17 04:30:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:ZFW2K8qpfdmT1vZAR2ZI1AY2LTQaUJ/nP7LvpqyEeQj7paMzaES:ZFHK8gkvuQIu3TQjnXpqykjNaKa
Threatray 1'423 similar samples on MalwareBazaar
TLSH T157D48D17BAB6CD70DA645B3BD28231208F3DDEC56593FA8A284D33E81D76B635D09207
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 31f098b29298f031 (53 x AgentTesla, 30 x Formbook, 12 x RedLineStealer)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
319
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/455125/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.45681.10659.5439.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Launching a process
Creating a file
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm masquerade packed
Link:
https://www.filescan.io/uploads/652e0e06d9aa13270184f8ad/reports/7eddef8f-138c-464f-bb38-41783b67ccf1/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/b9e042ace2e1ac33cfefd677bb466fe867ba7dbb277ba2716542b8601bda4a13
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1ed17a51-8966-44ea-b6a1-3f8590dc0590
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1326983
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1326983 Sample: SecuriteInfo.com.Trojan.Pac... Startdate: 17/10/2023 Architecture: WINDOWS Score: 100 27 api.telegram.org 2->27 41 Found malware configuration 2->41 43 Antivirus / Scanner detection for submitted sample 2->43 45 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->45 47 10 other signatures 2->47 7 SecuriteInfo.com.Trojan.Packed2.45681.10659.5439.exe 3 2->7         started        10 WindowSecurityxy.exe 2 2->10         started        12 WindowSecurityxy.exe 1 2->12         started        signatures3 process4 signatures5 49 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 7->49 51 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 7->51 14 MSBuild.exe 16 4 7->14         started        19 MSBuild.exe 7->19         started        21 conhost.exe 10->21         started        23 conhost.exe 12->23         started        process6 dnsIp7 29 api.telegram.org 149.154.167.220, 443, 49712 TELEGRAMRU United Kingdom 14->29 25 C:\Users\user\...\WindowSecurityxy.exe, PE32 14->25 dropped 31 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->31 33 Tries to steal Mail credentials (via file / registry access) 14->33 35 Tries to harvest and steal browser information (history, passwords, etc) 14->35 37 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->37 39 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 19->39 file8 signatures9
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b9e042ace2e1ac33cfefd677bb466fe867ba7dbb277ba2716542b8601bda4a13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b9e042ace2e1ac33cfefd677bb466fe867ba7dbb277ba2716542b8601bda4a13/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-10-17 04:31:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
19 of 23 (82.61%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xhqeflhc4gwdht7p2z33wrtp5bt3u7n3e552e4lfik4gag62jijq._file
Verdict:
malicious
Similar samples:
28533fbb167059524fb63906320201575b19fa3674f03b558a42e18fd7523f3a
AgentTesla
28b806003008a60c97b8ee66a3754b6fd9b73fb89a953111ba5238fee42e6053
AgentTesla
4239478f1ff05d0014ba2492e155e733b661473d7299cbf98eb8f81bbf6e719a
AgentTesla
58639b55ef4faebf0a6ab625ecdd348508fab2fc433a1dcc2bee02b20bee2078
AgentTesla
5f6110fdf11e888a353ffc60086f15c12deb42a07eec9d8b842589bfa67176dc
AgentTesla
7590cb175c30e90638d9d0f168add1c0cb66d769917ebc3052a9235618a5582b
AgentTesla
ad21aff38e3b20ca7c9c7236977dfb0821d515962cb5c705d8a5b9a8cbc43859
AgentTesla
b9d4088106a3a557fb5d909c8c5b921971704d7b764306ee4190cefd9b8d89b0
AgentTesla
ec50c4dbfaf63807aa7eab2af9c1bc46b66553bc1da16f1aede4dd8096b8bcd5
AgentTesla
+ 1'413 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/231017-e5c2wahc41/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot6049148844:AAEYOuZtq-yhuAqklwntW8KydQU37_oywUw/
Unpacked files
SH256 hash:
a97dc3bcc9f74026535289656e7482c621546a8c2698c6f91e1ce16a62b16040
MD5 hash:
74bf45858dd6ebc767ef6f81cbf81262
SHA1 hash:
bc7937e4895cd3e3c9361160da1a733589fae3d4
Link:
https://www.unpac.me/results/09f64d39-ad35-4def-9d72-1e8401516356/
SH256 hash:
6f112f5ef16d95f345b44794640fb2e6b9fe2544ff3fdaa98ad5d075e4f4da2f
MD5 hash:
a00d79da44a523c8700f453a5b3b45a0
SHA1 hash:
8145f19aad9a8ce1c91e70a9cc9a582a665524d9
Link:
https://www.unpac.me/results/09f64d39-ad35-4def-9d72-1e8401516356/
SH256 hash:
26f0b9e68000306f618bdf65eaa8077d489ed67e8341c9805048157251689c02
MD5 hash:
bf16eedffbefb38a9b0bd8d7de617e2d
SHA1 hash:
337fef497ae07d190c43fe6ef6ea39542297dcdb
Link:
https://www.unpac.me/results/09f64d39-ad35-4def-9d72-1e8401516356/
SH256 hash:
b9e042ace2e1ac33cfefd677bb466fe867ba7dbb277ba2716542b8601bda4a13
MD5 hash:
5e6e62c7d0b755d3a5de09599c5c21b0
SHA1 hash:
a26253e9c30dd6e1baa5045db0d62af1556bc89b
Link:
https://www.unpac.me/results/09f64d39-ad35-4def-9d72-1e8401516356/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b9e042ace2e1ac33cfefd677bb466fe867ba7dbb277ba2716542b8601bda4a13

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_bytecodes_sep_2023
Create hunting rule
Author:Matthew @embee_research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/455125/

Comments