MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf12c9e6d2c7f82dca4d50f764088b6391b51e64feda78bd87c57ac5655f8c28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 12

Intelligence 12 IOCs 1 YARA 21 File information Comments

SHA256 hash:	bf12c9e6d2c7f82dca4d50f764088b6391b51e64feda78bd87c57ac5655f8c28
SHA3-384 hash:	86791de735a360c6952f0a31474069f925a30861d891eae9aaba8be901e44467f02a4dab03cb790774fe9cd65dcd2c08
SHA1 hash:	ed46c62614196244917f71ce98a847b0c2c54682
MD5 hash:	5c4b66dd3523dc466c231384646142e8
humanhash:	fanta-one-salami-india
File name:	5c4b66dd3523dc466c231384646142e8.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	187'392 bytes
First seen:	2025-01-26 06:40:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'752 x AgentTesla, 19'657 x Formbook, 12'248 x SnakeKeylogger)
ssdeep	3072:1Y1BdhUDNdkA+LGP34odAerVUzeeDXbwa21D59ua/aHyvZRVd2iP:1Y1/hUK1bwv
TLSH	T11204074977F4490AF9BE6B3248714D496370E4925923EB0D4FC244A96F33780CD9BBA7
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10522/11/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

AgentTesla C2:
http://f0541260.xsph.ru/api.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://f0541260.xsph.ru/api.php	https://threatfox.abuse.ch/ioc/137726/

Intelligence

File Origin

# of uploads :

# of downloads :

588

Origin country :

Vendor Threat Intelligence

Detection(s):

Win.Malware.AgentTesla-6952874-1

Win.Dropper.Razy-6519812-0

Win.Malware.Barys-6820546-0

Win.Packed.Barys-6841771-0

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Creating a window

Connecting to a non-recommended domain

Sending an HTTP POST request

Moving of the original file

Verdict:

Malicious

Labled as:

MSIL.Krypt.Generic

Link:

https://www.hybrid-analysis.com/sample/bf12c9e6d2c7f82dca4d50f764088b6391b51e64feda78bd87c57ac5655f8c28

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/234a5b16-16f2-407d-a33e-75af271ed3c9

Result

Threat name:

Agent Tesla, AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1599677

Signature

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Contains functionality to capture screen (.Net source)

Detected Agent Tesla keylogger

Found malware configuration

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Moves itself to temp directory

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/bf12c9e6d2c7f82dca4d50f764088b6391b51e64feda78bd87c57ac5655f8c28

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bf12c9e6d2c7f82dca4d50f764088b6391b51e64feda78bd87c57ac5655f8c28/

Threat name:

ByteCode-MSIL.Backdoor.Remcos

Status:

Malicious

First seen:

2025-01-09 18:14:26 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 24 (100.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x4jmtzwsy74c3ssnkd3wicelmoi3khte73nhrpmhyv5mkzk7rqua._file

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery

Link:

https://tria.ge/reports/250126-hfrqhsvmbv/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

System Location Discovery: System Language Discovery

Looks up external IP address via web service

Verdict:

Malicious

Tags:

stealer agent_tesla Win.Malware.AgentTesla-6952874-1 agenttesla

YARA:

agent_tesla AgentTesla AgentTeslaV2 MALWARE_Win_AgentTeslaV3 MALWARE_Win_AgentTeslaV2

Link:

https://app.threat.zone/submission/505ce5ef-217b-4efb-a16d-9037b59ffcd0

Unpacked files

SH256 hash:

bdf0b602219666385561f4604040b703ead9062dfeba9327879a0f0df0634a73

MD5 hash:

4f0ce1247640779e62d5f15ff48f7e68

SHA1 hash:

2f443597161996e9ee27e6a6ceb419d2b3f24bda

Link:

https://www.unpac.me/results/58005b6d-69f0-4c50-be49-2c7eab029e41/

SH256 hash:

2601666186f980cc33c5cb309fec1351502d02d54bc5ffa0a975776f58a7d6ea

MD5 hash:

849d5e4645e61d26ecc9a77e58681f20

SHA1 hash:

4a9361c8e21b7473249bdc669ef087dbc6bf823f

Link:

https://www.unpac.me/results/58005b6d-69f0-4c50-be49-2c7eab029e41/

SH256 hash:

bf12c9e6d2c7f82dca4d50f764088b6391b51e64feda78bd87c57ac5655f8c28

MD5 hash:

5c4b66dd3523dc466c231384646142e8

SHA1 hash:

ed46c62614196244917f71ce98a847b0c2c54682

Detections:

win_agent_tesla_g1

Link:

https://www.unpac.me/results/58005b6d-69f0-4c50-be49-2c7eab029e41/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bf12c9e6d2c7f82dca4d50f764088b6391b51e64feda78bd87c57ac5655f8c28

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla Create hunting rule
Author:	kevoreilly
Description:	AgentTesla Payload

Rule name:	AgentTeslaV2 Create hunting rule
Author:	ditekshen
Description:	AgenetTesla Type 2 Keylogger payload

Rule name:	AgentTesla_mod_tough_mem Create hunting rule
Author:	James_inthe_box
Reference:	https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/

Rule name:	agent_tesla Create hunting rule
Author:	Stormshield
Description:	Detecting HTML strings used by Agent Tesla malware

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifacts observed in infostealers

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	MALWARE_Win_AgentTeslaV2 Create hunting rule
Author:	ditekSHen
Description:	AgenetTesla Type 2 Keylogger payload

Rule name:	MALWARE_Win_AgentTeslaV3 Create hunting rule
Author:	ditekSHen
Description:	AgentTeslaV3 infostealer payload

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETDLLMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample