MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8f09ceb5f0956277b36af5b751c353891420250fc5aab01538e8d78f5861934. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments

SHA256 hash:	d8f09ceb5f0956277b36af5b751c353891420250fc5aab01538e8d78f5861934
SHA3-384 hash:	aa5f7677310c2b694bf9d0420841c25bddb90ddd222c14c44ee30e570aea5c5079ee492c49bc411faf40b7b0ccdfd81a
SHA1 hash:	571a024ef53d137b059db3be669055f53a330d98
MD5 hash:	0e0d42c0458316bd7693b442251d7ff2
humanhash:	leopard-texas-mississippi-lamp
File name:	0e0d42c0458316bd7693b442251d7ff2.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	232'960 bytes
First seen:	2021-11-20 09:56:53 UTC
Last seen:	2021-11-20 12:16:08 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	6144:yKDcVBww1GjCiC7PSavnIi+GjebhCb/ngn:yKDcViw1GjCiGaavnIi+GjebhCb/ngn
Threatray	1'611 similar samples on MalwareBazaar
TLSH	T16B34A39D365072DFC867D872DEA82C64FA60747B930B9203A01726EDEA4D997CF150F2
File icon (PE):
dhash icon	00b0f0e8ecccd800 (1 x AgentTesla)
Reporter	abuse_ch
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

113

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

f1637376911.zip

Verdict:

Malicious activity

Analysis date:

2021-11-20 02:56:32 UTC

Tags:

evasion trojan loader opendir rat redline stealer raccoon vidar

Link:

https://app.any.run/tasks/60da0df5-1081-4598-993f-f3edc2309ed8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Gathering data

Detection(s):

SecuriteInfo.com.Variant.Tedy.5044.29564.30044.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

DNS request

Sending an HTTP GET request

Launching a process

Creating a file

Creating a window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

confuserex obfuscated packed

Link:

https://www.filescan.io/uploads/6198c66f359656727c9e694b/reports/e68bdab4-14d2-4e74-a044-0b31b2e32d17/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4b1b12ce-55e8-4444-bc5b-d58d387ff501

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/893080

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d8f09ceb5f0956277b36af5b751c353891420250fc5aab01538e8d78f5861934/

Threat name:

ByteCode-MSIL.Adware.Tedy

Status:

Malicious

First seen:

2021-11-20 01:17:04 UTC

AV detection:

18 of 27 (66.67%)

Threat level:

1/5

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

335b76a90cab7fb6708add00a72e811968fd9c0be4c19a7a1e75aad02acb9679

AgentTesla

486a4e75e6160a9dd36971ef4442063568d340c97b672c55f0c5856878cb7e7d

AgentTesla

b64cc3011b334fe3fdc47852da28f1d865a1f71dd819827a035b9b3adab1a163

AgentTesla

e045b4a1c9f6640814f6e39903e1f03f2c7f1e3b3d1c6dbf07a409732655eff4

AgentTesla

e34fc70bee3b2e9051e1115f1053aec2bbd3555a8d71600e90890662ea718ff1

AgentTesla

f2866d013e000884415fa13490799a626792a29967bf20e7bbbf23a72c0fd7f7

AgentTesla

+ 1'601 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/211120-lyx7ssffe9/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Unpacked files

SH256 hash:

0551c124b8aef3d741db3919c6a21ba4a84f3f494200fefc12e9b23015505734

MD5 hash:

8a080ba59a1002e983a857836e4dc497

SHA1 hash:

ee8ab51066b2a9b8f8f255619d4b13feda865565

Link:

https://www.unpac.me/results/f4941270-dd7c-4f5d-8a6f-b2d3a1030fb0/

SH256 hash:

03bcabe9facbd8387eb24e0620edb72c8d2707d9d71301ce6bb12f5551ed1f0d

MD5 hash:

3f82a488ec8cd3cba64fca408fb8c42e

SHA1 hash:

9c4ca9afa24a1ac65deb10df4109cee5625de2e9

Link:

https://www.unpac.me/results/f4941270-dd7c-4f5d-8a6f-b2d3a1030fb0/

SH256 hash:

d8f09ceb5f0956277b36af5b751c353891420250fc5aab01538e8d78f5861934

MD5 hash:

0e0d42c0458316bd7693b442251d7ff2

SHA1 hash:

571a024ef53d137b059db3be669055f53a330d98

Link:

https://www.unpac.me/results/f4941270-dd7c-4f5d-8a6f-b2d3a1030fb0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.50

Link:

https://yomi.yoroi.company/submissions/d8f09ceb5f0956277b36af5b751c353891420250fc5aab01538e8d78f5861934

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_ConfuserEx Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_NET_NAME_ConfuserEx Create hunting rule
Author:	Arnim Rupp
Description:	Detects ConfuserEx packed file
Reference:	https://github.com/yck1509/ConfuserEx