MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d11c0f5febcc93e63347d730f9e7c841db54ec0c7e10a2c3a2bfaea6905e7782. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 13

Intelligence 13 IOCs YARA 1 File information Comments

SHA256 hash:	d11c0f5febcc93e63347d730f9e7c841db54ec0c7e10a2c3a2bfaea6905e7782
SHA3-384 hash:	cfc7bc7c038e054a29d8c0a5fcc789154c488cde4e76e723f38c76b70d755bf965c9fd2812d75ba6006b6cdfb3e7bcdf
SHA1 hash:	17023d06e2c3555ece75bd8444e097ed0b2fe686
MD5 hash:	fb269d33b6d51d0e977e146a99871e64
humanhash:	south-alpha-hydrogen-cup
File name:	fb269d33b6d51d0e977e146a99871e64.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	489'695 bytes
First seen:	2023-01-13 16:57:26 UTC
Last seen:	2023-01-13 18:38:31 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 429 x GuLoader)
ssdeep	6144:xYa6EL56cM62ctEasiaxcU+d/pY0jvs5jeQ4/EyBNvS9aQzT/pjnaS3kV2u:xY0t9Ez3xFspOa9seNvfIFjaS0Au
Threatray	25'100 similar samples on MalwareBazaar
TLSH	T192A40102EB508973D5254B769EFB5B8AA3786F522F061B2F231CF14D78F36015B4A728
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter	abuse_ch
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

173

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

fb269d33b6d51d0e977e146a99871e64.exe

Verdict:

Malicious activity

Analysis date:

2023-01-13 17:10:24 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3602ad89-5f4c-49da-bca3-d06fa561927c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/352693/

Detection(s):

SecuriteInfo.com.Trojan.Agent.GCIH.5069.30953.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Creating a process from a recently created file

Using the Windows Management Instrumentation requests

Reading critical registry keys

Setting a keyboard event handler

DNS request

Sending a custom TCP request

Creating a file in the %AppData% subdirectories

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Stealing user critical data

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/60093/overview

Behaviour

MalwareBazaar

Verdict:

No Threat

Threat level:

10/10

Confidence:

83%

Tags:

overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/63c18d9b71fb096abeed8411/reports/fd395681-5886-478e-ad05-6473b8676176/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/80315536-f5c4-469a-bc47-af240508580c

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1151312

Signature

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Installs a global keyboard hook

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d11c0f5febcc93e63347d730f9e7c841db54ec0c7e10a2c3a2bfaea6905e7782/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-01-13 08:18:01 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 39 (48.72%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2eoa6x7lzsj6mm2h24yptz6iihnvj3ampyikfq5cx6xknec6o6ba._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

2a0393524bb81273a391ec8a495de0d0bbbe17c064c081121637b125d6bfb2f5

AgentTesla

306886293861cc5086f510c84661f1921e680e945052667f5f4ab1f6ef5abec6

AgentTesla

564e748a2164cc70ec2c77d9830e301dedc3439f165fd8cc798bbd53fa168862

AgentTesla

8c4cc2077f0eab36be58bb86b34035f1b9c133902630526f609ff0c194f4f236

AgentTesla

a482218c80bb91030f21119952bad2383fc9a5b69dfcd954b5b80585858fbd56

AgentTesla

cb4c05bf0a3cc9a2157b5b7799e3bdad472a0b677743ebb59803fa8934def97f

AgentTesla

+ 25'090 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

collection spyware stealer

Link:

https://tria.ge/reports/230113-vgvj1see2y/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Executes dropped EXE

Unpacked files

SH256 hash:

ecb258fdd48f28a582fd1709203a000218b545044dabce748efa88193c410e38

MD5 hash:

c5519453bae4a7691abeafcecc9b4b00

SHA1 hash:

ddfad4502827d8c88aaf91830c4152bf1809a51e

Link:

https://www.unpac.me/results/bdb5178b-f90e-4d62-829f-0f97859012c6/

SH256 hash:

d11c0f5febcc93e63347d730f9e7c841db54ec0c7e10a2c3a2bfaea6905e7782

MD5 hash:

fb269d33b6d51d0e977e146a99871e64

SHA1 hash:

17023d06e2c3555ece75bd8444e097ed0b2fe686

Link:

https://www.unpac.me/results/bdb5178b-f90e-4d62-829f-0f97859012c6/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d11c0f5febcc/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d11c0f5febcc93e63347d730f9e7c841db54ec0c7e10a2c3a2bfaea6905e7782

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.