MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 be1de67e009a039d6075c654d7423d82b0ff7a26a851240664fe48c135a0f1b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 16
| SHA256 hash: | be1de67e009a039d6075c654d7423d82b0ff7a26a851240664fe48c135a0f1b4 |
|---|---|
| SHA3-384 hash: | 6070af73ecbcc5c76b6e358d501eccbd55c2bc5beeee578ab95b5ebd34070e494d3603105c953291b25cce5fa8035580 |
| SHA1 hash: | 0eec92c4fc5860d0985e9b0e16b6b0111311a4f8 |
| MD5 hash: | cd8d048fe7bddec7b26f26efa428f5ab |
| humanhash: | enemy-pasta-six-seventeen |
| File name: | SOA of AUG 2023_pdf.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 1'127'936 bytes |
| First seen: | 2023-08-09 13:06:35 UTC |
| Last seen: | 2023-08-09 13:34:33 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:glDupEO6YTJHBnJsgk45MkvbiRornr41ZsXVa7LJI:gApEsVJsgJlvbja4w |
| Threatray | 215 similar samples on MalwareBazaar |
| TLSH | T15C357B3C11286A8CF3A586FCB6744CFF17A46D2F80BBF9F3985CA4D706A97D05502266 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  James_inthe_box |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
292
Origin country :
USVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SOA of AUG 2023_pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-08-09 14:53:57 UTC
Tags:
evasion snake keylogger trojan
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
masquerade packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Verdict:
Malicious
Result
Threat name:
Snake Keylogger
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected BrowserPasswordDump
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.SnakeStealer
Status:
Malicious
First seen:
2023-08-09 00:32:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
17 of 38 (44.74%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 205 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
5fa142ca60affa38366a7d5629656a3eac379303ae3e11ace85bfa43ea2fcead
MD5 hash:
228c4530d532c57edc855c41d6b5de05
SHA1 hash:
fbfd35c558066c2f1eb1be203362d27b7aa4f00a
SH256 hash:
e22e7f09d743e524d134f4b4bbf5f1eb5308a3edb954a40b8aa5e68c7b8cffd4
MD5 hash:
07e1f7163b7d8b6d80d83d1c819436ef
SHA1 hash:
ed7724c52e18b9810939327b803ca03837915836
SH256 hash:
a8c322de62eb1fd94cf8510593f3183f1435251aaba5e9a27ad877fe9a65968e
MD5 hash:
ac55f54fc77e45788f5067286a1d65e0
SHA1 hash:
d7352dc00abb7c28f81fb1347103761b132dce69
SH256 hash:
504410fd6158a7346f5a2e7b7714203b329d46dab5d129719410d5c325122804
MD5 hash:
74ed681a2d7aed1dae5627d4367474f8
SHA1 hash:
cad2df636d3f0710f69fdb18cbae03a332341dd3
SH256 hash:
b3b478a4c3f955d2b2c391a95a2a9f4cac5a3b621a4e4205aa337c6972137694
MD5 hash:
a9385b2d17d0f51dc47eba0a50395a22
SHA1 hash:
c52b3ac4a0ebba788a2ec651226c4fb1763dbee5
Detections:
snake_keylogger
SH256 hash:
4bc0541974fe00584a554a0ea43ec7b17ec1896158afba11af489aae14702a74
MD5 hash:
15123ce9106d171fc538d3ae045922ee
SHA1 hash:
7642e8cbef5108b91e178c6b30ef6ae45d8d4924
SH256 hash:
be1de67e009a039d6075c654d7423d82b0ff7a26a851240664fe48c135a0f1b4
MD5 hash:
cd8d048fe7bddec7b26f26efa428f5ab
SHA1 hash:
0eec92c4fc5860d0985e9b0e16b6b0111311a4f8
Malware family:
SnakeKeylogger
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.