MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c48c301c70e75c95d192049ed30c1d2f4d32717b67139aad468a6de1d5550dca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 19

Intelligence 19 IOCs YARA 7 File information Comments 1

SHA256 hash:	c48c301c70e75c95d192049ed30c1d2f4d32717b67139aad468a6de1d5550dca
SHA3-384 hash:	b4de72f3ba5028dcf730743129060dd25b67baa4309832fe72c43d48190b3761a9eb6a6af219e762142ea95f2529284a
SHA1 hash:	e6fb1e2e73acf67569315c3d9f47f85d36aa3e0b
MD5 hash:	9db0aa4d2c28205d89536de9244cb7e8
humanhash:	edward-don-early-april
File name:	9db0aa4d2c28205d89536de9244cb7e8
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'037'824 bytes
First seen:	2023-10-14 04:04:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'611 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:UFBXecyPM0fPFoMpUNdV9JOYvJ1pos0r:aBucUtRpUz8ao
Threatray	277 similar samples on MalwareBazaar
TLSH	T10B25F32C0CF809124161E1AEDFD8EA57B2C08CD6664C9D9687C68F995A1393BF09FD3D
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	zbetcheckin
Tags:	32 AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

334

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

9db0aa4d2c28205d89536de9244cb7e8

Verdict:

Malicious activity

Analysis date:

2023-10-14 04:07:21 UTC

Tags:

agenttesla stealer

Link:

https://app.any.run/tasks/45c069c2-5a56-459f-99de-c6c8eae83918

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/454264/

Detection(s):

Porcupine.Malware.58887.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

control lolbin packed replace

Link:

https://www.filescan.io/uploads/652a1370e66ef03f17797790/reports/4a860b5e-54f2-446a-bc54-2449d03b9a6a/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/c48c301c70e75c95d192049ed30c1d2f4d32717b67139aad468a6de1d5550dca

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/131c3588-9fe8-4a0f-85bf-d5d74394b768

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1325592

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large strings

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/c48c301c70e75c95d192049ed30c1d2f4d32717b67139aad468a6de1d5550dca

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/c48c301c70e75c95d192049ed30c1d2f4d32717b67139aad468a6de1d5550dca/

Threat name:

Win32.Backdoor.Bladabhindi

Status:

Malicious

First seen:

2023-10-14 00:48:12 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

16 of 23 (69.57%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ysgdahdq45ojlumsaspngda5f5gte4l3m4jzvlkgrjw6dvkvbxfa._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

12b2fba3e9d8b5d287e3d9e6fb6fe2ed7f1652bce0af56d5dabf93c38fbf723b

AgentTesla

493e3d54159cd3ebde6aa0b5216ddcb14863b4b064bb80c654353838926d191d

AgentTesla

6430cbc0e6f2b70a615188a247f4bbd049c8ef133c8522cc04b57bee370cbebf

AgentTesla

870cab3485ccd3044de362a787d27fde60667472fbe196541ba19e658fef57ae

AgentTesla

88a4db278dbd7534d6e9faa9c13838cf53b251aec51e46a025012debe54bc99b

AgentTesla

d52275a861a9396629e78edca76c3b3cec55980115feadfd0e93ca9c400bbffa

AgentTesla

e579952e0a6c558c001274aa13e6ac8297a3991497f0163917e6db3a37430f83

AgentTesla

+ 267 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231014-enhk2ahf75/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

AgentTesla

Unpacked files

SH256 hash:

a040efb5ce92995b5d40fd2536c8ad6a93f2d8584a3dd52f07cdb0b34c9e6e29

MD5 hash:

a5a52675690de850e3de6c05a9bd885f

SHA1 hash:

fd953edf2e910fbb43c9e6d4c8d48632bb4e55c6

Link:

https://www.unpac.me/results/2c8b4eec-5386-489a-9f65-2ffa9884772b/

SH256 hash:

b1270dc9ec3f22c6fd2296239426ac7c48589589580d4a1b3da8188920b22a63

MD5 hash:

5c904da8528cfb1b87b15a6aa7c059cd

SHA1 hash:

f0a192969485d1bc34bf52adf37d9c20176d6b85

Link:

https://www.unpac.me/results/2c8b4eec-5386-489a-9f65-2ffa9884772b/

SH256 hash:

6ae945893bc0c8d57c615f0ac9eff03752aed042ba5c599bd5c5c035db082182

MD5 hash:

e46d713114c41562f1cab015d99dc5c5

SHA1 hash:

9f60d3ed19343db8a34de64e5ce2fc81d58f99dd

Link:

https://www.unpac.me/results/2c8b4eec-5386-489a-9f65-2ffa9884772b/

SH256 hash:

90d9c203070aa9ee80dce9132414862bf917326d61385c98a05e21e44ef5c349

MD5 hash:

0078dcf029269f5ef4788fadb3926337

SHA1 hash:

2f4fc93c041722aa3bac71a2399ae4a704334ed1

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/2c8b4eec-5386-489a-9f65-2ffa9884772b/

Parent samples :

41250765ce8be9fb830cfd0ca91b82a7018d7859b6cd90a80de2f83eb365cc2b
deecc3c9f68be8ed49e4adc8fdeb2569618f7770d60c955ac60e65251801ffd8
a9c8b6ec1d3d72ddb29a511e1fc672176d5a3637cb57a32c40d3043af22bed5f
65370cfa1e08f458d53cb661cf02054d9324f155a7bbf6505b4da5c2f9492385
235f214f8493ad0784c683df8ad2b3bb3fc4125d90b900ac44241acdc43a28fa
3e4ece1631713f959b5949c5f639c18777ccdbf2728b0083e57be6908636c9fe
07cfa4984b99d3fb354c156fb7db24103897c28a7486aaa34ccfcd255a8ee153
b498e97b1d956d64107b85334404aec3e2c16dde1a664385e4d959b32aaabe1e
d52d43f6a2620e365367d5c26d1d219547d416730893179f5b37df6983d1c743
4c5c92dd8f43ed66f1cca431f7cb09c72d5e90202455c88150c0afbe9bae29ec
8a6575788812abf874d6fd5c6bf536121372c2311a94b370e93c6e0ea74b1546
001970c1e2e043a76cacb7b7e0e8e59294262820832b05df8f28e0dd925a45fb
396b5562de7bc8b4652e763c8241d7b55aaa02c563278597163b768acdfc306d
c34e81fe62af4f81b2bf0d42095b27a0e70db3dc28d0399e1c3477ad9bdf6764
cdf6f805ecc70e4ca41b5e344059d9b45495d4a4229ac1caec22d609b39ed1e6
ca717a839eb9ef1e0a9029cbc232a54cebaab99ebe8f4c467297d37ac09c512e
f594785f5e53cbd721f6d848329765aaca8b3527c79d75eb5cfb013ed7cf7cb1
c48c301c70e75c95d192049ed30c1d2f4d32717b67139aad468a6de1d5550dca
90d9c203070aa9ee80dce9132414862bf917326d61385c98a05e21e44ef5c349

SH256 hash:

c48c301c70e75c95d192049ed30c1d2f4d32717b67139aad468a6de1d5550dca

MD5 hash:

9db0aa4d2c28205d89536de9244cb7e8

SHA1 hash:

e6fb1e2e73acf67569315c3d9f47f85d36aa3e0b

Link:

https://www.unpac.me/results/2c8b4eec-5386-489a-9f65-2ffa9884772b/

Malware family:

AgentTesla.v4

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c48c301c70e7/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c48c301c70e75c95d192049ed30c1d2f4d32717b67139aad468a6de1d5550dca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	MSIL_SUSP_OBFUSC_XorStringsNet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:	https://github.com/dr4k0nia/yara-rules

Rule name:	msil_susp_obf_xorstringsnet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

exe c48c301c70e75c95d192049ed30c1d2f4d32717b67139aad468a6de1d5550dca

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/454264/

URLhaus

https://urlhaus.abuse.ch/url/2720408/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-10-14 04:04:14 UTC

url : hxxp://185.28.39.18:7777/185.28.39.18/humblezx.exe