MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bf7683710b995d5fef6a54af481950c11be88d14f49b45815be07eb149ffb18c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 17
| SHA256 hash: | bf7683710b995d5fef6a54af481950c11be88d14f49b45815be07eb149ffb18c |
|---|---|
| SHA3-384 hash: | 52cd14b7b77d67e8ba305fe02b0581103d9bb025d0820a2255131f4c7ef31ef69681e0fff948ea9ba0e778817b4a73de |
| SHA1 hash: | b4c3272aa05138cc473d28593015a6549c0dc1ea |
| MD5 hash: | ebf3233ae74cc600e4c41f2454be000f |
| humanhash: | papa-sad-september-zulu |
| File name: | logszx.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 588'288 bytes |
| First seen: | 2023-07-12 09:23:49 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'476 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:BPmp530RbTSz+PLTS5zdSeqJxvZ1vumICbtN8YZ8Jmo0xgJ8:RQ5ERb+gTmQnvZ8wb8YZ8JmT |
| Threatray | 5'018 similar samples on MalwareBazaar |
| TLSH | T15AC4230567B66F74C0AB4BF9219506B06BFE95DA3831C3410E87B0DD9B8AB4507A0F6F |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter | Anonymous |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
276
Origin country :
DEVendor Threat Intelligence
Malware family:
agenttesla
ID:
1
File name:
logszx.doc
Verdict:
Malicious activity
Analysis date:
2023-07-12 09:23:55 UTC
Tags:
exploit cve-2017-11882 loader agenttesla stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
comodo jigsaw packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Detection:
agenttesla
Threat name:
ByteCode-MSIL.Hacktool.Mimikatz
Status:
Malicious
First seen:
2023-07-12 09:24:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
16 of 24 (66.67%)
Threat level:
1/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 5'008 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
8da0f0efe0bd146de47c3470187251dc898608b0cbbde3c94fc4a4965f4cb6a4
MD5 hash:
0b85c8071e5f76a44abb8e4b5a7ffbdf
SHA1 hash:
e2a7cca48180081524bc0f61042486290a3e8aec
Detections:
AgentTeslaXorStringsNet
Parent samples :
bf7683710b995d5fef6a54af481950c11be88d14f49b45815be07eb149ffb18c
29e92566e2158cc45c25be94067d2a604a9abc06cdf7a35eee378b689ce91952
3c2fd1edcb67d300923a28556cd95e82ca5500098e9b2778d3498b003037ac8b
ef63e0dd98836048f72145f44b71d716b14262817d75574aa04731ebcf231c90
4fcc49b2eefbff7e79c4ff61b3891f766b8530a75e0a748fd66ffc67911cf377
b676171dc6dc8e2fd1737a88c2dd52370c1a800cc6ee18e947341395fc76bb17
29e92566e2158cc45c25be94067d2a604a9abc06cdf7a35eee378b689ce91952
3c2fd1edcb67d300923a28556cd95e82ca5500098e9b2778d3498b003037ac8b
ef63e0dd98836048f72145f44b71d716b14262817d75574aa04731ebcf231c90
4fcc49b2eefbff7e79c4ff61b3891f766b8530a75e0a748fd66ffc67911cf377
b676171dc6dc8e2fd1737a88c2dd52370c1a800cc6ee18e947341395fc76bb17
SH256 hash:
7c743d979549f931d7101d1a14c14841ff47c848a3f30e31882d0d958bf5f941
MD5 hash:
508ba12479b3d78edb93f63b40ab3b7f
SHA1 hash:
d72b842c46546e4e494c9338b530e305dae1d5d2
SH256 hash:
c9df0298c324b64c246f2c8b463fafa9b282bd71748a4d3ca8125430542b416b
MD5 hash:
929fc1c4dfcb4efe825cefa1af7ae65d
SHA1 hash:
82be2662f742c40d5429112f4bfdc5c41c8b5cd6
SH256 hash:
3e24c77fe108059f14fe61b8400c5fe023dc2b0ec7c4fe23fa9911681086f7a9
MD5 hash:
a5228b97b33467ac41fac5cac2718252
SHA1 hash:
28bb020c8a53b046fc8e8106f2913e62c5941a0d
SH256 hash:
bf7683710b995d5fef6a54af481950c11be88d14f49b45815be07eb149ffb18c
MD5 hash:
ebf3233ae74cc600e4c41f2454be000f
SHA1 hash:
b4c3272aa05138cc473d28593015a6549c0dc1ea
Malware family:
AgentTesla
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.