MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c9d75a27ed76fa8006bbfb067fca6f80506535a83914f7ae44e238c0f816c26d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 14
| SHA256 hash: | c9d75a27ed76fa8006bbfb067fca6f80506535a83914f7ae44e238c0f816c26d |
|---|---|
| SHA3-384 hash: | cef106e50b4a15a4c3d7425a458db4c4a82b9e504c8cbdd571ce9a00a0b9d483d466f8f59defa19ccfba9def95af169d |
| SHA1 hash: | f2353b16f2ad5c107da9e71eb2e892ba50cd26e3 |
| MD5 hash: | 525ca32af4b1c81bfd195fe190488398 |
| humanhash: | mango-bravo-tennis-carbon |
| File name: | Scan_Document_doc.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 664'576 bytes |
| First seen: | 2024-01-09 12:55:53 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:qT5rrTJSbDBe6qNpZkTCJvGW4yloUniHDiWg/Fo9kIQcKPQo4rnS/g6TlFEevths:g5rpSnLqKTCZGOv6oo9qcKn4rmg6Ie1 |
| Threatray | 514 similar samples on MalwareBazaar |
| TLSH | T180E42306B2E48731E87927FA713191229BB378273456C50A7CC5B1CFD767B24EA42E63 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter | Anonymous |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
331
Origin country :
PLVendor Threat Intelligence
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Launching a process
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
masquerade packed
Verdict:
Malicious
Labled as:
Trojan.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
MSIL Injector
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2024-01-09 01:18:53 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
22 of 37 (59.46%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
agenttesla
Similar samples:
+ 504 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
f4c6e4738ae5626c9867d5fa5894127203870c3cac9fcdb76dbae0c3ce88bc1c
MD5 hash:
630922fe41a133e6e0e49c2e7003fb65
SHA1 hash:
b2f4955b5cc3fce04a04754cfd7d2c61f3da8f07
Detections:
win_formbook_w0
win_formbook_g0
SH256 hash:
da43bc6bc0659407ea9ab73001bd9d2569017fa6386915d4d4671e64c9be5056
MD5 hash:
d3a98684bc01380a4507354399f7616c
SHA1 hash:
e26048cd342489a826e629cbe477a9838e2d0c9f
SH256 hash:
15328d71446897ed88a7e8fa1707800832c508420590e17c0f3908fc1bf5d3f8
MD5 hash:
bedcfd95a804ec74a2d236b727debd6e
SHA1 hash:
90b921f216c00e6b27d0e62861830104da360fca
SH256 hash:
21afe82a0b71ee589c26f32dc88e0a6e22817f21194b2a83f1807c6cecc8c818
MD5 hash:
440bb4db146ccb1161ac2bcf365d7676
SHA1 hash:
506eda511b46df6e95d86861e70fda81307f8623
SH256 hash:
7f3ef4658a1b5cff1d0964a68f69d36821f8eacb079cd2f43d007897eb7ab0cb
MD5 hash:
3801a4e3937b0b8ab1f2cd8ca16e478c
SHA1 hash:
31bb63eff712380866c11e5591756df45f9965d7
SH256 hash:
25c1d0c1cbd141414e65d3f6b229142c668b50a4f5095a9292e771cf0879613f
MD5 hash:
6905e1fe9debe516867eaa04649e5822
SHA1 hash:
e1ba5b3adf4150bee4341039f80b629821cdeb45
SH256 hash:
a0ee3bfcbcffef04fbb1d9dfe796c2c7cfeb9553ff8b659ff00cd635d41d02e7
MD5 hash:
c61ed1ea3028aa937f2a450ebe69ab14
SHA1 hash:
ad021f53033e162ead649d163cf679ab5bd85cdb
SH256 hash:
ca0cb02e5fdc7395519b440a5a2c5f6a608bcdb0c0efae85a394672274655de9
MD5 hash:
4e7490857dcdda2a9f6507d7151f75db
SHA1 hash:
9ba68a203f7ac61949e3c4d5fde658e421f41e05
SH256 hash:
35bc0bec4e465107880e3ad6f4a62691f46c45bd087d7890660a397d7179081e
MD5 hash:
3b8a60d0e5b81087f685c1c10d0cda0a
SHA1 hash:
54dfb7feb791c8e4b1610fbaf090dc322765caa7
SH256 hash:
8e18e74f3ac8275275b2c13160386321456b88be6e11e076c5e29cf00e722d21
MD5 hash:
4235bc6394a42e844d3bc39e6203c895
SHA1 hash:
24ad12120d5529d126b89e06244151d6083fb7ea
SH256 hash:
24003d4517295e92a652ce1446a4e206937ed3f300ec1faa6bb89f736bf25918
MD5 hash:
f4b961c4c6c770b3ef0bb738bfe2c874
SHA1 hash:
0eceb7a08b5311c26477e4572ef8f0db75258280
SH256 hash:
c9d75a27ed76fa8006bbfb067fca6f80506535a83914f7ae44e238c0f816c26d
MD5 hash:
525ca32af4b1c81bfd195fe190488398
SHA1 hash:
f2353b16f2ad5c107da9e71eb2e892ba50cd26e3
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DebuggerCheck__GlobalFlags |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Active |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Thread |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | maldoc_find_kernel32_base_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | maldoc_getEIP_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.