MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bacfce630c06766a1c54b55395b84232dfb01a99844a0c732fa45470d9bd434b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bacfce630c06766a1c54b55395b84232dfb01a99844a0c732fa45470d9bd434b
SHA3-384 hash: 9290d9f735bcd60dbee05dba71cba2364663abbd93d1e4b65bd39e49ad180cfbba1b5fc607e5c3c5e409fba11bb27350
SHA1 hash: e5e5cf0a3c5d645bcbc171dfa7e1943e3be53508
MD5 hash: e16678adff0c94c5c107ff9e3672a6c9
humanhash: solar-whiskey-high-seventeen
File name:openssl.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:13'184'512 bytes
First seen:2023-10-03 20:54:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 49152:bK32UW/tIMGh2aiASiUyDA147Bf6w9o1grqRykI6c4V/HJY/oFTYpKA3hLAuewii:
Threatray 572 similar samples on MalwareBazaar
TLSH T130D628243DFB5019B2B3EF9A4BE8B8EAD96FF6733B066469105003864723D41DDD163A
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter vovaan
Tags:AgentTesla dropper exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
371
Origin country :
CH CH
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.AutoIt-CRO.3254.29127.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file
Creating a window
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Moving a recently created file
Reading critical registry keys
Unauthorized injection to a recently created process
Stealing user critical data
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/651c7fa7723bacbcf8d48ee7/reports/94fd2c03-d4a7-4d32-b658-26b711b93420/overview
Verdict:
Malicious
Labled as:
MSIL.Binder.Generic
Link:
https://www.hybrid-analysis.com/sample/bacfce630c06766a1c54b55395b84232dfb01a99844a0c732fa45470d9bd434b
Result
Verdict:
MALICIOUS
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/194097f0-1a8b-44d4-a99d-c9ac333cf022
Result
Threat name:
Agent Tesla, AgentTesla
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1319039
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Antivirus / Scanner detection for submitted sample
Contains functionality to capture screen (.Net source)
Detected Agent Tesla keylogger
Drops executable to a common third party application directory
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1319039 Sample: openssl.exe Startdate: 03/10/2023 Architecture: WINDOWS Score: 76 48 rakishev.net 2->48 76 Malicious sample detected (through community Yara rule) 2->76 78 Antivirus / Scanner detection for submitted sample 2->78 80 Multi AV Scanner detection for dropped file 2->80 82 8 other signatures 2->82 10 openssl.exe 6 2->10         started        signatures3 process4 file5 40 C:\Users\user\AppData\...\6G7NT6MZ.exe, PE32 10->40 dropped 42 C:\ProgramData\USOPrivate\25U45TR6.exe, PE32 10->42 dropped 84 Drops executable to a common third party application directory 10->84 14 25U45TR6.exe 16 18 10->14         started        19 6G7NT6MZ.exe 2 10->19         started        21 conhost.exe 10->21         started        signatures6 process7 dnsIp8 62 checkip.dyndns.com 193.122.130.0, 49794, 80 ORACLE-BMC-31898US United States 14->62 64 104.21.88.34, 443, 49953, 49954 CLOUDFLARENETUS United States 14->64 66 2 other IPs or domains 14->66 44 C:\Users\user\AppData\...\tmpG855.tmp (copy), PE32 14->44 dropped 68 Multi AV Scanner detection for dropped file 14->68 70 Detected Agent Tesla keylogger 14->70 72 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->72 74 5 other signatures 14->74 46 C:\Users\user\AppData\Local\...\6G7NT6MZ.tmp, PE32 19->46 dropped 23 6G7NT6MZ.tmp 24 92 19->23         started        file9 signatures10 process11 file12 32 C:\Windows\System32\libssl-3-x64.dll, PE32+ 23->32 dropped 34 C:\Windows\System32\libcrypto-3-x64.dll, PE32+ 23->34 dropped 36 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 23->36 dropped 38 35 other files (none is malicious) 23->38 dropped 26 chrome.exe 1 23->26         started        process13 dnsIp14 50 192.168.2.1 unknown unknown 26->50 52 192.168.2.4 unknown unknown 26->52 54 2 other IPs or domains 26->54 29 chrome.exe 26->29         started        process15 dnsIp16 56 www.google.com 142.251.16.99, 443, 49863, 49977 GOOGLEUS United States 29->56 58 accounts.google.com 172.253.122.84, 443, 49821 GOOGLEUS United States 29->58 60 15 other IPs or domains 29->60
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bacfce630c06766a1c54b55395b84232dfb01a99844a0c732fa45470d9bd434b/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2023-10-03 20:55:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
18 of 23 (78.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xlh44yymaz3guhcuwvjzloccglp3aguzqrfay4zpurkhbwn5infq._file
Verdict:
malicious
Similar samples:
2ce2a95e577db4e056811389f7b7eee5184e5f0e42730f7ae823db1b253401e8
AgentTesla
3206681fc7e7974569ebe9f97d513de0aa4e21b8e657523ec411b296b7a20b70
AgentTesla
5498127f11928bb91062949e7f2d2a140164036490563db5fcfb85c29e4d3e1f
AgentTesla
5c860b74570161b2dd12484a69682907e6f48b163094be586e06fad45d580a03
AgentTesla
630c670e2a7d49cba82a68aa324da4ea80e0cba429f2da39e52375aac154a283
AgentTesla
6b8dac8326076b76369a8eb4e316a86a7663b597aeffe89b35e86c02aa5df4c0
AgentTesla
72e8ea93fb9881413437161535b9a6206f7aabeafd9b86b025f2b7e32025ffdc
AgentTesla
f5302b9e1f7a2c2c69ce10c5975d4ceee06a7cec5a9b834fd63dece231838fe7
AgentTesla
+ 562 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection spyware stealer
Link:
https://tria.ge/reports/231003-zqe8xahd83/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
e68c90060aae27c50f1649f8cc09aad8bd5a6ca6c133d19bbc843977bf822f0c
MD5 hash:
bb914c22f30611934e2bc44b7c9a2a25
SHA1 hash:
3a90042db76f35390b89bb0c52d6b24391d83c30
Link:
https://www.unpac.me/results/b2c9d169-85db-4b90-a9e6-3079fccbec4e/
SH256 hash:
948ce4952f2ae39a5db002acaebba5deb54fa5742d69977dc0bb087d2ab2e2a9
MD5 hash:
1a17a64471057ab792f756874114d241
SHA1 hash:
6b444a2854eaa58a69058e1b906d9145729d1cd0
Detections:
win_agent_tesla_g1
Create hunting rule
Link:
https://www.unpac.me/results/b2c9d169-85db-4b90-a9e6-3079fccbec4e/
SH256 hash:
ee53096736435f4862b697dfe928bb35ce129f4d999e9f24355fdcf9882c732d
MD5 hash:
33c91d0e7b3d2748999b944f6551217e
SHA1 hash:
3149d19a29ed8af1e4de8333b68766ded33a1ca6
Link:
https://www.unpac.me/results/b2c9d169-85db-4b90-a9e6-3079fccbec4e/
SH256 hash:
d55800a825792f55999abdad199dfa54f3184417215a298910f2c12cd9cc31ee
MD5 hash:
bfb160a89f4a607a60464631ed3ed9fd
SHA1 hash:
1c981ef3eea8548a30e8d7bf8d0d61f9224288dd
Link:
https://www.unpac.me/results/b2c9d169-85db-4b90-a9e6-3079fccbec4e/
SH256 hash:
bacfce630c06766a1c54b55395b84232dfb01a99844a0c732fa45470d9bd434b
MD5 hash:
e16678adff0c94c5c107ff9e3672a6c9
SHA1 hash:
e5e5cf0a3c5d645bcbc171dfa7e1943e3be53508
Link:
https://www.unpac.me/results/b2c9d169-85db-4b90-a9e6-3079fccbec4e/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bacfce630c06/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bacfce630c06766a1c54b55395b84232dfb01a99844a0c732fa45470d9bd434b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RSharedStrings
Create hunting rule
Author:Katie Kleemola
Description:identifiers for remote and gmremote
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe bacfce630c06766a1c54b55395b84232dfb01a99844a0c732fa45470d9bd434b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2716277/
  
Delivery method
Distributed via web download

Comments