MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d88ca1dd2194d68703b49f6aeb18e8d2a08132d5f348b9d0cfaa96b90a87384d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 16

Intelligence 16 IOCs YARA 9 File information Comments 1

SHA256 hash:	d88ca1dd2194d68703b49f6aeb18e8d2a08132d5f348b9d0cfaa96b90a87384d
SHA3-384 hash:	b3fd13e420a8f0d3be0b0035ecda114a9aad6f7d2e44cc17c7123babac12d7a9de8f62110b6dec35df8d4e98036573b1
SHA1 hash:	6dd92106494804fedff7c76d8f94b0bf63c50ef6
MD5 hash:	d78d90977bd9addab19038a3367f7804
humanhash:	social-minnesota-berlin-potato
File name:	d78d90977bd9addab19038a3367f7804
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	540'160 bytes
First seen:	2023-08-15 12:31:05 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:WyFV/OUAdO5DrcMFfsuS65OsYQiAZZXH/KmizaGhtD5ph0toL:WyyjdO58+sf6kJmimizRDhK
Threatray	5'492 similar samples on MalwareBazaar
TLSH	T19DB41204B6BC2F52D5BAD3F9CA10855643B8656FA573E34C9EE270D60E26B201B11F2F
TrID	69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4505/5/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter	zbetcheckin
Tags:	32 AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

281

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.13938.19416

Verdict:

Malicious activity

Analysis date:

2023-08-15 11:44:13 UTC

Tags:

exploit cve-2017-11882 loader stealer agenttesla

Link:

https://app.any.run/tasks/4c025d02-fd46-423e-9725-a2bf5983110c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/442788/

Detection(s):

Porcupine.Malware.58887.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

clipbanker comodo darkkomet packed

Link:

https://www.filescan.io/uploads/64db70432a1db2a88ad0c8eb/reports/6c4c64f5-c1aa-4b06-92e4-757cd9d58ad6/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/d88ca1dd2194d68703b49f6aeb18e8d2a08132d5f348b9d0cfaa96b90a87384d

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c626290d-c881-42f8-b355-57ac82da2150

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1291408

Signature

.NET source code contains potential unpacker

Found malware configuration

Installs a global keyboard hook

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/d88ca1dd2194d68703b49f6aeb18e8d2a08132d5f348b9d0cfaa96b90a87384d/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-08-15 09:30:04 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=3cgkdxjbstlioa5ut5vowghi2kqicmwv6neltugpvkllscuhhbgq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

2c738c2b15bab621c7f94261438463073c45ec6b30c922bf65d7857e177ee1cc

AgentTesla

449947dedfa89870f0f4d5dc86edc66c4656a6f94504167bbe4f803cd5c16076

AgentTesla

6a3bc2efcecdd25c5257e19e630b5785dc9e8ebb259773d40d2fc4c19e377285

AgentTesla

9db20870570e93875292e6a6a5f7683982cbe675135032c7dafc2b9704f3cb06

AgentTesla

9f08469a0b761c0d950446b84a2cdba032bc93c0f92abbd63352ec399506248d

AgentTesla

af093bd71cb66c24a34d31d6efa125d86e6ffa89bfbfad9d20658889553e133d

AgentTesla

d71f0f448eaf4589f3e415bf5fd1ccc10d6ef85f2279539c263c4f6928836bda

AgentTesla

+ 5'482 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230815-pql2cacf3y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

ec105615b0b24604afbd275446e91e82c05735bdba9cd54e029ca865071645bc

MD5 hash:

596a16803dc1dc19b205359154ca03df

SHA1 hash:

c64683a3824d138cab03164b342c27fef6fe454d

Link:

https://www.unpac.me/results/a83ff511-01cd-4e51-aac5-47377320e80b/

SH256 hash:

d49b6b98ce2072303df26f7fdd3bcf642267bd4d44be0bbbfabf7e9742618dd8

MD5 hash:

9668fa7d79bba30a0080007d155a5bd4

SHA1 hash:

c3df87d81ec44a86f03d12e8184fd9d8f2365233

Link:

https://www.unpac.me/results/a83ff511-01cd-4e51-aac5-47377320e80b/

SH256 hash:

2ac2f55e15fd8da559f99925ceee9166ca978e94cbc53a5cb29bf02d0a76ac7f

MD5 hash:

1081db0b25581c7958e6fbff4d9aa64a

SHA1 hash:

bcb0e0fe844884a5b0d05cd3b0cc5fd7a5ff53b9

Link:

https://www.unpac.me/results/a83ff511-01cd-4e51-aac5-47377320e80b/

SH256 hash:

860c585efce5028bdb69b719d1758c1ccb0fb603c057faa01ddf5ed96d6c6a9e

MD5 hash:

ac9f563df4b2ea6143835d9aa84aaa92

SHA1 hash:

28239fa9359a77c5e45ed07b45f2632f86afb123

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/a83ff511-01cd-4e51-aac5-47377320e80b/

Parent samples :

9f08469a0b761c0d950446b84a2cdba032bc93c0f92abbd63352ec399506248d
9db20870570e93875292e6a6a5f7683982cbe675135032c7dafc2b9704f3cb06
af093bd71cb66c24a34d31d6efa125d86e6ffa89bfbfad9d20658889553e133d
21275ed11f8b1b1b08d98607acd7c5ae3e1ad733782f91daf53be5b84feb0bd5
2c738c2b15bab621c7f94261438463073c45ec6b30c922bf65d7857e177ee1cc
aa20731e5adf5003b9fae77ddb9cf1284f0089aaf435f63a92bc2b17e6e1048b
d88ca1dd2194d68703b49f6aeb18e8d2a08132d5f348b9d0cfaa96b90a87384d
aed4ca29e0127320a814f0051b444338d8078cd79ee176c9db4a14c989dbf0c3
29e9fcdaf070133121d5a2d5dcb5f4a4a25892e21c60e1d29a497ddaa8d54ea9
b3eefb7225c8437ba7e9c6800ffdc0f2bb42225246bc7cc4944ba343b40459dc
ad79217dc98d23b4c3e99fe39b7a554671c5d13b2ea29a2013f8f86b2d904a07

SH256 hash:

d88ca1dd2194d68703b49f6aeb18e8d2a08132d5f348b9d0cfaa96b90a87384d

MD5 hash:

d78d90977bd9addab19038a3367f7804

SHA1 hash:

6dd92106494804fedff7c76d8f94b0bf63c50ef6

Link:

https://www.unpac.me/results/a83ff511-01cd-4e51-aac5-47377320e80b/

Malware family:

AgentTesla.v4

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d88ca1dd2194/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV4 Create hunting rule
Author:	Rony (r0ny_123)

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	MSIL_SUSP_OBFUSC_XorStringsNet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:	https://github.com/dr4k0nia/yara-rules

Rule name:	msil_susp_obf_xorstringsnet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

exe d88ca1dd2194d68703b49f6aeb18e8d2a08132d5f348b9d0cfaa96b90a87384d

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2704671/

Cape

https://www.capesandbox.com/analysis/442788/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-08-15 12:31:06 UTC

url : hxxp://2.59.254.18/_errorpages/yugozx.exe