MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c7859e38dac67d93a0be63264364683ce6fd6b22f9145fdf7f45294458cae5a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 16
| SHA256 hash: | c7859e38dac67d93a0be63264364683ce6fd6b22f9145fdf7f45294458cae5a0 |
|---|---|
| SHA3-384 hash: | f9aecd0c5910576140eea44b37fb364e5ad80544ee2ae1387ff37f630468f71531a9dd1d3e26e00fa696377e5e383342 |
| SHA1 hash: | 281b9fae658ea6c29b4b75a635f03be80c412ed5 |
| MD5 hash: | 25a194979b7a1c0b1f0c367d71aa2eb0 |
| humanhash: | black-cola-enemy-magnesium |
| File name: | new order 00029485886459966 dated 25012023.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 411'925 bytes |
| First seen: | 2023-01-25 07:59:35 UTC |
| Last seen: | 2023-01-25 08:23:08 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 431 x GuLoader) |
| ssdeep | 12288:vY4rBIDQeHEurQugZ+BprU3uT4DrKbBSlF3HL:vY4aDQdur/583KbBSlF3HL |
| Threatray | 26'266 similar samples on MalwareBazaar |
| TLSH | T1529423407A71C42BFE121E3D2DB653B02BC9D94114A8DB5B17A04EFA7D3A3518E2AF61 |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla) |
| Reporter |  lowmal3 |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
211
Origin country :
DEVendor Threat Intelligence
Malware family:
agenttesla
ID:
1
File name:
new order 00029485886459966 dated 25012023.exe
Verdict:
Malicious activity
Analysis date:
2023-01-25 08:01:54 UTC
Tags:
trojan rat agenttesla
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
Verdict:
No Threat
Threat level:
2/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains very large array initializations
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-01-25 08:16:18 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
22 of 25 (88.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 26'256 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla
Unpacked files
SH256 hash:
e4aaf19ab58a9336085234c8064d42ab2506305d80a8738656f2f63b1b6e395b
MD5 hash:
53bafceb44f66074283ebee1a297eba9
SHA1 hash:
aa429c19fb377151b239f7db5f670aadc027ae1f
Detections:
AgentTesla
Parent samples :
c7cc9b494022ce3e0e73f9da5a6e8c1ba4541b012c0b73be4bb4a10b2eb4c801
c0d0fe7c94e5eea8895b8b3d1a82cf8030883e1e3a5404966761d08a29063d89
c496880015b8aca953669bbfefd71f7c777370e3c12b042d6556f3e8c96d886c
8fd45841fb13a3559678bffcc6aa5d583c9d38918a5657aa8fa0337821adb237
571b5a5b56217afed525b3602ef2b894650c6c419fc18e70bfe74e2973e207f2
c7859e38dac67d93a0be63264364683ce6fd6b22f9145fdf7f45294458cae5a0
31f74743aed6aabe5af121a44785c9e68b951a7d16849873d346503d79868246
67d4ee9e6ff5fbe379250a946da129ed87a24d5d519d223450b7dfd885b4ab11
5efb7a214b43bc47d505091c168ad6ef30706a7632a98b080460895845ded776
c0d0fe7c94e5eea8895b8b3d1a82cf8030883e1e3a5404966761d08a29063d89
c496880015b8aca953669bbfefd71f7c777370e3c12b042d6556f3e8c96d886c
8fd45841fb13a3559678bffcc6aa5d583c9d38918a5657aa8fa0337821adb237
571b5a5b56217afed525b3602ef2b894650c6c419fc18e70bfe74e2973e207f2
c7859e38dac67d93a0be63264364683ce6fd6b22f9145fdf7f45294458cae5a0
31f74743aed6aabe5af121a44785c9e68b951a7d16849873d346503d79868246
67d4ee9e6ff5fbe379250a946da129ed87a24d5d519d223450b7dfd885b4ab11
5efb7a214b43bc47d505091c168ad6ef30706a7632a98b080460895845ded776
SH256 hash:
4701fef26304a884edb874f39db648ce7960993f67648c8b246d427203d6c389
MD5 hash:
4db2ca85829ee8b721f583c80d44bf83
SHA1 hash:
06fd84d59ec2e6a74d5685697205fc63d9a38eab
SH256 hash:
bc2d7d37d081a8d89484b8deb63ba72ad749984f439cfa819802df2110fc963f
MD5 hash:
aa447741f043fd63e9f5ea8002cf8623
SHA1 hash:
41b718523089dfe3b8e0f8d0236f05563d47e72c
SH256 hash:
c7859e38dac67d93a0be63264364683ce6fd6b22f9145fdf7f45294458cae5a0
MD5 hash:
25a194979b7a1c0b1f0c367d71aa2eb0
SHA1 hash:
281b9fae658ea6c29b4b75a635f03be80c412ed5
Malware family:
AgentTesla.v3
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.