MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2f9b55d138def6ce13aee0438e44e97ea60199e1e707f57e42c625fb305764a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2f9b55d138def6ce13aee0438e44e97ea60199e1e707f57e42c625fb305764a
SHA3-384 hash: 5a7925e6c807a17833e30efd2d1dd9c5c3858516df21e01572008d1c9cfad363c53fd642be97de1c44072f1c2da6c307
SHA1 hash: 1cbd7cb6b0c2445c27456d999e77df9369bdca3d
MD5 hash: 5092537a72fd01a36badb8572689bbb3
humanhash: solar-don-football-magazine
File name:5092537a72fd01a36badb8572689bbb3.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:846'848 bytes
First seen:2023-03-07 14:21:13 UTC
Last seen:2023-03-07 15:50:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:G6CCF1W6ZesX2vB9OLmnoUkjresEZMY8NDunZJDkSS0:G6CCF1W6ZesX2vB9OLmoUkjdEZMVaJDh
Threatray 1'267 similar samples on MalwareBazaar
TLSH T14005380B643E9002F49D21B51B12272FBE78D66D5E67E6F23685546BD00AE233FC2B35
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5092537a72fd01a36badb8572689bbb3.exe
Verdict:
Malicious activity
Analysis date:
2023-03-07 14:44:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a53500cc-1c48-424c-8c94-eb6d58c9ed3f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/372342/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6407488de96aa01651234bc5/reports/6fe4be94-4dee-4750-94be-5d1d8a111deb/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/c2f9b55d138def6ce13aee0438e44e97ea60199e1e707f57e42c625fb305764a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7fe452a9-f7c4-4f70-b9cd-d1176d919405
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1188776
Signature
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2f9b55d138def6ce13aee0438e44e97ea60199e1e707f57e42c625fb305764a/
Threat name:
ByteCode-MSIL.Trojan.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2023-03-06 19:56:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
19 of 25 (76.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yl43kxitrxxwzyj25ycdrzcos7vgagm6dzyh6v7efrrf7myfozfa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
01d4c768eb131e8f7e2ffef8bc17f9ceb629ffdb3dd4a6364aaf8096bdd16161
AgentTesla
11113117a5262f41a4bbed276aec8faf760afaafbfd1c3c05e945aa1d3e911bd
AgentTesla
1e9b8c2056adf69d35b941a8514df02180ec6b2ff81ce8011023ba33ec2be203
AgentTesla
3191fe463f8c9a91ccf9ed9a81daef803f9c184fcb093b24ffafa1f2f318eb64
AgentTesla
7e0dd3b9557b18226181b4c0356499edd472030f975bcfc44a7fbfd56f7661a4
AgentTesla
7ea54a151d7340d97ccc3d53dbf82900b2205f0df10b0571a12501ecaad5359d
AgentTesla
9b2b9f8f70057a1d60700f490e59ae93972ce2fdfb852770ae08fdfff72a0611
AgentTesla
9fe5448efcfb0a3d75204877140d9eeaa00ba0b84374742d1df5b03b6d41961e
AgentTesla
aced5165801c3fae21fb69b21d9dbaea768a5cc075186c660a81685ceba0dc1b
AgentTesla
+ 1'257 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230307-rplqashg8s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
498c0460da26cfc2c4ec95b9b394bbd3db719ba08ccbd5964a533bc9006dcf8f
MD5 hash:
f4e7e91d4fdda2d3feb401b5b1d53abf
SHA1 hash:
cf9e76e6418850ac853bd9c6ce82a0be7920fc1d
Link:
https://www.unpac.me/results/ec87158d-e55f-4545-99cd-9c20c3b38eb2/
SH256 hash:
b91d408db079c48aa356721b87ca5723c42b5c3729de73f454d6fe999b91585f
MD5 hash:
c130a4f695184c338f79f35265ed9929
SHA1 hash:
6f38d60ebc0b54c42caef1761cc880782aec6503
Link:
https://www.unpac.me/results/ec87158d-e55f-4545-99cd-9c20c3b38eb2/
SH256 hash:
8617cea503c2a3961120a9c503d853bc21d38d1fca7143d6b1ef4f388bc5cec7
MD5 hash:
7f225c69df031bf0560aed3847a1221a
SHA1 hash:
4d5f3ccdb2c6015d2b2a73326c0f32b173af2819
Link:
https://www.unpac.me/results/ec87158d-e55f-4545-99cd-9c20c3b38eb2/
SH256 hash:
65f2d98ab17c209d6e5546c548e60b073ed7e73c02e8d834fb382a12735f6ae6
MD5 hash:
6ae4aa9e917d85e16bbb08c97bfa3b9d
SHA1 hash:
31f781736d253e684d50f8c1085fecf96eef68a5
Link:
https://www.unpac.me/results/ec87158d-e55f-4545-99cd-9c20c3b38eb2/
SH256 hash:
efcb18587026e7fdc22bb1801a3d66c3323e8c4027b8441c5e3da03788a8b0bd
MD5 hash:
b29e25f8458de593ee77befd52de7866
SHA1 hash:
12cf7a2d5b161d709ae482004033b8396fa147c4
Link:
https://www.unpac.me/results/ec87158d-e55f-4545-99cd-9c20c3b38eb2/
SH256 hash:
c2f9b55d138def6ce13aee0438e44e97ea60199e1e707f57e42c625fb305764a
MD5 hash:
5092537a72fd01a36badb8572689bbb3
SHA1 hash:
1cbd7cb6b0c2445c27456d999e77df9369bdca3d
Link:
https://www.unpac.me/results/ec87158d-e55f-4545-99cd-9c20c3b38eb2/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c2f9b55d138d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2f9b55d138def6ce13aee0438e44e97ea60199e1e707f57e42c625fb305764a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe c2f9b55d138def6ce13aee0438e44e97ea60199e1e707f57e42c625fb305764a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2556804/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/372342/

Comments