MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d90e0253bfeade7d67308491d33d278e48311838b12e23cf19ab62cacde2e844. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d90e0253bfeade7d67308491d33d278e48311838b12e23cf19ab62cacde2e844
SHA3-384 hash: e1756e1653447feb4e095e46c47df511615c169cad2839a8525dad5f28e4b7a794295df42389b2a2055d8660b215e8e5
SHA1 hash: 0a3bb2b742cc683884ea3ccc7b2f0c3e5b2fe2b9
MD5 hash: 08125df26aae667da4e9e9b3086a7ea4
humanhash: kentucky-angel-colorado-network
File name:08125df26aae667da4e9e9b3086a7ea4.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:707'584 bytes
First seen:2023-01-23 19:06:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:2C66Bm2iNNcadIVUumcKl/Tg/wy5yKyj9VYru6ldb+WZ8jWJ166B:rVM1rcmnu5KLbKyjzYr/ld/ZiWJ1V
Threatray 25'732 similar samples on MalwareBazaar
TLSH T1CDE401512DA8C558F2F91BBD1F2C461D8FB01D8927E3E2B90BE270D99973B47C815872
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:AgentTesla exe Telegram

Intelligence

File Origin
# of uploads :
1
# of downloads :
166
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
PROPERTY SALES CONTRACT DOCUMENTS.doc
Verdict:
Malicious activity
Analysis date:
2023-01-23 18:49:55 UTC
Tags:
trojan loader exploit cve-2017-11882 agenttesla
Link:
https://app.any.run/tasks/8f9e9bc7-ae92-479b-b932-cab7fd7ee55b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/356072/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
No Threat
Threat level:
  2/10
Confidence:
75%
Tags:
packed
Link:
https://www.filescan.io/uploads/63cedad9447edb203a006f8d/reports/0c8501cd-b025-47f2-a7b0-3d6f0b01b2c8/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/538268c0-783c-4e64-bd77-d56734b6b7d3
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1157302
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Telegram RAT
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d90e0253bfeade7d67308491d33d278e48311838b12e23cf19ab62cacde2e844/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ehaeu575lph2zzqqsi5gpjhrzedcgbywexchtyzvnrmvtpc5bca._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
440ea2ee8ce0040d8915262110fc3a99d3970f1da78c162edc86e2b25c50a579
AgentTesla
4e1310dcbe61956354f58b7a45254e17974d431691e4eb21aebe8fcf92b8ef34
AgentTesla
4fb64ce7d358d24f8f6feb96dd1e0fb56b8899b008d80a0ea7754a1aff50c793
AgentTesla
a2655dc19c1fbba64ea94b3de86d8cbe1ad1e8bdf0ef1234fd5717f6feae61f2
AgentTesla
c8d7e38a611b60fe03397645b2ae0b3bc2aaa9604c68c81f0baf6565b813fb35
AgentTesla
f6480ba23bca3c0d32c4283dca79ea9f898d2ff622fdf3fef0fece48b1ab790d
AgentTesla
+ 25'722 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230123-xsnlysge4s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla payload
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot1977970812:AAHd8pA2REAwdAB_6eJ-9nZj90oz8OYGjrI/sendDocument
Unpacked files
SH256 hash:
984361037ca528c10fde95c584605630fb913b25b48c942699a6e86d3bc6a6e2
MD5 hash:
a03b18be934e30381d5c316a54e95388
SHA1 hash:
e422da7fca3ba6213e7e0ba93e56369ace0f8139
Link:
https://www.unpac.me/results/c5b85ae3-1d17-4885-b737-ff9d1805f954/
SH256 hash:
5e52ce02a1297d4d91d07304349eb8c353d9b5ca0c031cadd451975580e2ffea
MD5 hash:
ba49b2344c4b7e799d958bd2d4b01ead
SHA1 hash:
31802cc42b0ebbb687fb455825ced47d272fc27c
Detections:
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/c5b85ae3-1d17-4885-b737-ff9d1805f954/
Parent samples :
f6480ba23bca3c0d32c4283dca79ea9f898d2ff622fdf3fef0fece48b1ab790d
c8d7e38a611b60fe03397645b2ae0b3bc2aaa9604c68c81f0baf6565b813fb35
d90e0253bfeade7d67308491d33d278e48311838b12e23cf19ab62cacde2e844
e82d176acad25737b98dc721ba2fcee8cdfd3df29b0c4f73296e6b0e3b4947b1
5e52ce02a1297d4d91d07304349eb8c353d9b5ca0c031cadd451975580e2ffea
SH256 hash:
ff1b42ea7d56a37eae801adbddb7116f52a4664c0b41302736f522852edc2747
MD5 hash:
89ac57478044c57c7195943116a521e0
SHA1 hash:
1ff2bafeed795423e3538d810bda8e1e3fcdcfa5
Link:
https://www.unpac.me/results/c5b85ae3-1d17-4885-b737-ff9d1805f954/
SH256 hash:
40abe0611d45190debf905208ddefd75ff6bf7253be8d2de48de3572e60ca03f
MD5 hash:
ee42e8759ffff8a6272325dddd9ebf73
SHA1 hash:
1911c84116a4d582eea245d47d7cfb8ff361fafa
Link:
https://www.unpac.me/results/c5b85ae3-1d17-4885-b737-ff9d1805f954/
SH256 hash:
20eda0a9b642a495ee216f13d2c37603ef860ff1aa1b8c89b2aa630a17574f71
MD5 hash:
d2dcd2d712c1f3c871e39fc27f889546
SHA1 hash:
167502f0388eb8c9525a048282600fa83d7254ad
Link:
https://www.unpac.me/results/c5b85ae3-1d17-4885-b737-ff9d1805f954/
SH256 hash:
d90e0253bfeade7d67308491d33d278e48311838b12e23cf19ab62cacde2e844
MD5 hash:
08125df26aae667da4e9e9b3086a7ea4
SHA1 hash:
0a3bb2b742cc683884ea3ccc7b2f0c3e5b2fe2b9
Link:
https://www.unpac.me/results/c5b85ae3-1d17-4885-b737-ff9d1805f954/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d90e0253bfea/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.71
Link:
https://yomi.yoroi.company/submissions/d90e0253bfeade7d67308491d33d278e48311838b12e23cf19ab62cacde2e844

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe d90e0253bfeade7d67308491d33d278e48311838b12e23cf19ab62cacde2e844

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2513226/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/356072/

Comments