MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4aacef823ff0e408cc83eabb90157bae1171f133b387e1e2ec389842676cb3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 16

Intelligence 16 IOCs YARA 4 File information Comments

SHA256 hash:	d4aacef823ff0e408cc83eabb90157bae1171f133b387e1e2ec389842676cb3c
SHA3-384 hash:	e89203610b29da164dc3d591f1f27c1901ee9c36f5bc59fe25447969db62fd5e3d5106ab5cabddb1617d3899f4cc85fe
SHA1 hash:	115cf76fb203ba72e1f9944eb15ced3484d92d06
MD5 hash:	257b1e9b94f744f83a4df2a3f5e847b5
humanhash:	ten-mars-network-five
File name:	d4aacef823ff0e408cc83eabb90157bae1171f133b387e1e2ec389842676cb3c
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	774'144 bytes
First seen:	2023-05-14 09:42:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:ebkcdXHwni4IyS+7VDtjQwlmg2Jsm8HLIADHS7PaPKmd5CWDNGNjoNr:ebJNwLHNuKmYUyzFr
Threatray	3'480 similar samples on MalwareBazaar
TLSH	T1BCF4F16710AAC341E03F87B079A8FD64176731DBE9E7AE39132928C54E5AB113C9C19F
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	petikvx
Tags:	AgentTesla

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

d4aacef823ff0e408cc83eabb90157bae1171f133b387e1e2ec389842676cb3c

Verdict:

Malicious activity

Analysis date:

2023-05-14 09:44:14 UTC

Tags:

rat agenttesla

Link:

https://app.any.run/tasks/a1d5507f-946d-4626-bb0c-c6de4115ec88

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

XorStringsNET

Link:

https://www.capesandbox.com/analysis/389328/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.66844219.32005.2882.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

formbook packed

Link:

https://www.filescan.io/uploads/6460ad2f9afafccc175d34dd/reports/a2009e8b-0e1f-4122-b770-a903ff61dc37/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/d4aacef823ff0e408cc83eabb90157bae1171f133b387e1e2ec389842676cb3c

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/86e5355c-16e1-462e-a30c-f9908c9e1833

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1232725

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d4aacef823ff0e408cc83eabb90157bae1171f133b387e1e2ec389842676cb3c/

Threat name:

ByteCode-MSIL.Spyware.Negasteal

Status:

Malicious

First seen:

2023-05-03 21:55:05 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2svm56bd74hebdgih2v3sakxxlqrohythm4h4hroyoeyijtwzm6a._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

130af4a0f76145a77e1814efbda5e34f0bb2f0d0a21f189c40fc595c768930fb

AgentTesla

26b70686814f11ee1cfc7490fc25dd5b49553e70f94903a710f7802b6f4ecb78

AgentTesla

660be0a4c68d2de50374918bc1c701274f9f46846fb1f29d6789ddba868a45f8

AgentTesla

71769693e34bd0116c96d55e1ec5f96090d8c1d38f1e037a83effc9de785f52c

AgentTesla

9776ff04f5a266245eb0837078897bf8bdc9dac49d9a5cea1f23c146d00c295c

AgentTesla

dff610d1e149c13ed0668d4802c1f876650383dc1777db71201c9e7ae57e1197

AgentTesla

ff2e4312ff6513d00f4e3959d47e63bff0be7bf3b3faf53d8491ff9129b1f334

AgentTesla

+ 3'470 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230514-lpxvnsbe28/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

06f7815673123551c85d99397ce8a67060db84192d597f264575d9af0f40ab23

MD5 hash:

f8b1b6d6249722c781d5689edea36610

SHA1 hash:

d99d70226b55f25122e7a3ea52a6c3173baab1ec

Link:

https://www.unpac.me/results/16f7df0f-bd02-4c67-8668-cfaf30658265/

SH256 hash:

40c050c20d957d26b932faf690f9c2933a194aa6607220103ec798f46ac03403

MD5 hash:

c768bac25fc6f0551a11310e7caba8d5

SHA1 hash:

95f9195e959fb48277c95d1dd1c97a4edff7cb3a

Link:

https://www.unpac.me/results/16f7df0f-bd02-4c67-8668-cfaf30658265/

SH256 hash:

aa9ae64d63460537ba08d4db72ad684f1153a8049c5f47b64441adf8f228db23

MD5 hash:

4314b306f1fb6ca6886c0cf11ab1470d

SHA1 hash:

662efc89c22248dd85ae705e0e0da5c28f479526

Link:

https://www.unpac.me/results/16f7df0f-bd02-4c67-8668-cfaf30658265/

SH256 hash:

71769693e34bd0116c96d55e1ec5f96090d8c1d38f1e037a83effc9de785f52c

MD5 hash:

f52ca7ec12ee4c905fd0c8888707076d

SHA1 hash:

05a60c21dc8ada56b848dbf8487cf371a0d2cabd

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/16f7df0f-bd02-4c67-8668-cfaf30658265/

Parent samples :

e6e90d14d8ae1df119d47eb1d5550d5f0eef77323dc95e576e3980a53e2555a3
1550a435aba0cb055a5412c79c4b3e659763f7eb78a8984e6471212b11c57d14
dc9592028314f25ba440ef8629468e39714188cdd0d681e76d2e8222bec8978c
bdcbe2ba28e1b1d3830fdd1ec17ff651e864892aacb288dcc21315e7ccba4b0a
e98bd4ed05c5d8f05861357156e67cf2eb1ece78e082e39abc9db81be3a408b5
d4aacef823ff0e408cc83eabb90157bae1171f133b387e1e2ec389842676cb3c
d649478667e016eb85bb4ef8cb5c96531547744fb444b1ee85bf6c0e4b3dcae2
ac79243f3e4c0ed820af9da511c8736fa82b71522ef90e0dd6baab1810160c1b
e04268f6e6265c7ad7f9c6f5e4edecce0cd7e3e399d096c288ab6089ab552734
fd0d5e94af637a6270fb09d1b157119c4e5b339cbd9f7f971ed08733985739f3
6ca31b46672e94e599a307894e5ff6d5e946b12a74e1270f54e0f12b7a37bdba
d94ff3cae0cda84338cd5a45ba92639c5e824a77a8de9f4e77a69b9307f3e69d
52d584d046ff850e6f965ea25018dfb6163cab3fb1d54cc5620b8bb87b2a6fec
634d85d5b533562ab4f53b5777a2b228067d400ed6a4151184d8b5b8c6dce151
9b39bf0f30b27ec3b6f017156cd1ad3b2ad08868392d9ecf3f9e01934cc8d0fd
4b0f3dd16fcd416c9cdcd55e292a5a04ee6c1114e99935118f375f10ec48b5bf

SH256 hash:

39e436a3f61a1371270a90927700ffcd3542e06ecdbdb3d8e248a894af01a464

MD5 hash:

80b26dfaeb5168ecb4310d18e4997545

SHA1 hash:

0573d4d4a80f7ce3e9d38701c7010a13061daf87

Link:

https://www.unpac.me/results/16f7df0f-bd02-4c67-8668-cfaf30658265/

SH256 hash:

d4aacef823ff0e408cc83eabb90157bae1171f133b387e1e2ec389842676cb3c

MD5 hash:

257b1e9b94f744f83a4df2a3f5e847b5

SHA1 hash:

115cf76fb203ba72e1f9944eb15ced3484d92d06

Link:

https://www.unpac.me/results/16f7df0f-bd02-4c67-8668-cfaf30658265/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d4aacef823ff/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/d4aacef823ff0e408cc83eabb90157bae1171f133b387e1e2ec389842676cb3c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_EXE_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:	Internal Research