MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db20bf3295f1aae23ce386ffb850622a77a474a8a1ddaf240965082ee03055bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 19


Intelligence 19 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db20bf3295f1aae23ce386ffb850622a77a474a8a1ddaf240965082ee03055bf
SHA3-384 hash: e5eea80f4aecac42a68e30100fc505ade0e05b1c7a37a5dba216b83f0bb445e4c75830ff93986f18ac5ac42134673909
SHA1 hash: fcb43bf83d5450d7d9e67624b3f402412ab817ac
MD5 hash: 722c821ad39dfa881452827cf5012955
humanhash: harry-apart-wisconsin-kentucky
File name:MT.Hunter - Vessel's Details.doc.scr
Download: download sample
Signature AgentTesla
Create hunting rule
File size:708'608 bytes
First seen:2024-08-21 05:29:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:DWgOoL3rlW4lq30hKzh1GRBrEO+rbGV7wKscBdPRPD/Fl5od1Wm/Ot:lFv4KOzmrUraV7wIRPD9EdF/
Threatray 3'939 similar samples on MalwareBazaar
TLSH T166E401447309D813CC614FB019B8D7B80F651EA8D910E3979EE9BDEF797AF896841283
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 71e896b2b296e871 (4 x AgentTesla, 2 x RedLineStealer, 2 x Loki)
Reporter threatcat_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
431
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
MT.Hunter - Vessel's Details.doc.scr
Verdict:
Malicious activity
Analysis date:
2024-08-21 05:32:31 UTC
Tags:
netreactor stealer evasion agenttesla ftp exfiltration
Link:
https://app.any.run/tasks/1439336c-7c4b-4bb0-808b-8a517448742e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.15402.12454.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66c57b5ce7ff3f5a063baca2
Tags:
Discovery Execution Infostealer Network Static Stealth Gensteal
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade packed vbnet
Link:
https://www.filescan.io/uploads/66c57b5ba3292d51061e2b65/reports/1c023602-427e-4666-877f-d0fe1ad6902a/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/db20bf3295f1aae23ce386ffb850622a77a474a8a1ddaf240965082ee03055bf
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/54c34478-a86e-4631-bcb0-a37ab4c8b5e0
Result
Threat name:
AgentTesla, PureLog Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1496342
Signature
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/db20bf3295f1aae23ce386ffb850622a77a474a8a1ddaf240965082ee03055bf
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/db20bf3295f1aae23ce386ffb850622a77a474a8a1ddaf240965082ee03055bf/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2024-08-21 05:07:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3mql6muv6gvoephdq373qudcfj32i5fiuho26jajmuec5ybqkw7q._file
Verdict:
malicious
Label(s):
agenttesla_v4
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
053c940f835b1c6624b6b0421b680da5c984b056734db107a7d6c8dfbe1837fd
AgentTesla
0899638cfa6353884fd28f5e4e99d61439ad14e53956b68e1b37253eede542a5
AgentTesla
8acf98103ca250e8dd4d0e507e87c51085de89a0faf2955fbc419d9354b3793a
AgentTesla
8e3db35284b6e1ea560c14a69ea4dfd6ef8e27fe9974a609116d00f2d764bfeb
AgentTesla
c1da889268db3a1dd91eda6f8696a9f9f6750012cf40f14fc3b38fc0d831610d
AgentTesla
e7864a121c2abe3f5398b03986d53cef01044dc8ba32e0cd30448d3ae8a78112
AgentTesla
fcb4c6602aeea8229338eab9ed2deb97c27e07601791ef19c7e43a830079e416
AgentTesla
+ 3'929 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla credential_access discovery execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/240821-f65zqawajk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Credentials from Password Stores: Credentials from Web Browsers
AgentTesla
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/38f53a94-5bab-445e-aa40-77a77735a17a
Unpacked files
SH256 hash:
41ca676a613453a6ab78a291617074038bb174a6d2586cba1bb9dbbc02247376
MD5 hash:
2f930a78f21b123787bc183fb113cf82
SHA1 hash:
e720782a5f0c3f4d6fadda2824a03e2d6c7e0e38
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/41400a1b-1bac-46fb-8b43-72f72ae14284/
Parent samples :
f4cc2743d202249ab338480e5c4cf22f2662065d078da09c89af833dbd1c1717
793683a76efa38f5ad0608e7a7419af3802b4a7cd5d3d428f2f1a7e6f0e6ad0e
db20bf3295f1aae23ce386ffb850622a77a474a8a1ddaf240965082ee03055bf
f817f8e18df662a17014911df81a6abf100c272717dd92426370a5a0f2c369e2
ef3551aae96f3756275e977c313b915120660a4c3c23390fb9a3a4b836989c2e
238b48a0994b2bd9e86d0670a02b6c6f7adde932512641b91165c3a489784d00
d71c77fa0c464289f6b7fb379d7fcbf0cdd6cc8d7bacf6c989a5f0eb5c215bab
823e15c33f7b0b8a824bb0d2eb2b4353b39726a314fa75c2e84b8c9f2dc0af81
67f7698cf905fa6f45d089dd007655e975fa267119499b92b6d0fe5a19ec7807
ea7576fd3d76d2e4cd771d7fd7bfd33bbc91645bf176b2d3381c811cd6658e71
c8bc2a9c8544716a04976357e3e6f338ae0c788bb0986912f07524ba36b6b3ee
317594b159dc16eaef361c1582a3e778aef2f790c30cd81c7b5d71067f27932f
74a5617fa4e4266a2756b6174f541116d2affde41698c40c5bb53c9192ba6bfc
10f0f9ee32494b68132fb2b33c3b6ff4c34c98b6b11e215b1f4de0570f37af5e
ca863343ef83e7233296780f9b43b17aaae114dfa1b418e0a45d0649cdb2fba4
b684fa6621ac71f22449614bfe6064d3cc91fd7aeb3c8d16fb6d586947c85bc3
b8dc14d25787d057a98f03c55c323cc7777c166dc49fb6af475255270735d90e
cd8fa8639bff7da69fb85932611eabaf7045d5c0db06c3a8d8ce2bf6a61d5a26
4fafedefad4ed526fe39782e0c0237a66044e201ac71e38da25d46ac99e76db8
1d2630f2a42e681f3f40139eb4b30458e1487ca38f5ac6d92a06dc127c4a2f66
0134e10653d086ff4aa1b1f708f4d93bce34bd2537c58d29fc576e141b51ed12
2cdf95d8ff803328ea7722320365275428d6e384f154dd504983fe4bc96a8a6a
c920a418d58520669f8f3d0db050c479bb16548283758221a24ad631e061fab7
2fd59b6b8675f9b08950f510c569cc5848f804f7dbebb8bece8815b30147885c
3a8365a1df445f73156d7f3886576b19d51acd84ba496eaa0c0040bf73f5bb16
7e10d81df9a9375a62ba1fab5eaee1db35d6f1ddf942518a534e0607f6032f84
4d58596777616fe9fbb75aef8c3ef57688cb3bab97d8690c850b57a12a84ba5d
41ca676a613453a6ab78a291617074038bb174a6d2586cba1bb9dbbc02247376
53fe324401f657157223fcbbf1a6d1c08d500b61c4d0d29f9413372abe8ec0c0
4ebdea4aa3734e9ebaea310b1a7fa600b5d9f3e489c61dbe7b3e2a3ab98d48c2
4ebeb928e56c30dc2fa722e5ae1e41181bfae00ce0466226bcb7d17a7dbaaae7
b62421cf478a292a99e3d253a7c36ad616ee06c83bada7b0b34a6365302acb69
743c48a643d48ec97873c45298b5e1a7133fe8471d73d367f10c68f362cc3afa
a977afa9d254b586f73b50eed60be03e124cee9bf9b1da069dc7d5fbcd24222b
3f3e5f6ad074cfe5d07c1d8854fad3ad3244d7a049ad1e44f1e1109eb8d3ff12
0dc243ac0911bc9c4dde3de9c48dcedd7478473a066f1b17ee2c4b7062f25795
SH256 hash:
2bfde305793352cc0da1adb8ed99447ad59f25f03c67d5756905cce802618749
MD5 hash:
90cebe77febe3d68f79fb7e03876149d
SHA1 hash:
a665a04102d72778358e1b045fe3dd46996d2fca
Detections:
win_agent_tesla_g2
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/41400a1b-1bac-46fb-8b43-72f72ae14284/
Parent samples :
bbe3fb7e0f0ddf898c7f5055707dcd5847cf14801f02563f384b75ffd06ece4b
8647436d5b5e93de1fbaf9571e584ceaee4a620cd39b60472da87e694239c317
c09cba9da1f8a6c8fbda87ce1c29455118eb13876286388a7d768ba98585aa78
d9af97e029e98b7502110beee9913df5132c5e1ad620e6b8124bd395c72131d9
fcb4c6602aeea8229338eab9ed2deb97c27e07601791ef19c7e43a830079e416
053c940f835b1c6624b6b0421b680da5c984b056734db107a7d6c8dfbe1837fd
8e3db35284b6e1ea560c14a69ea4dfd6ef8e27fe9974a609116d00f2d764bfeb
c9f0c595e62ee31b17e1b62cc7be551a1cd46c3395a282fead293a5033674328
793683a76efa38f5ad0608e7a7419af3802b4a7cd5d3d428f2f1a7e6f0e6ad0e
db20bf3295f1aae23ce386ffb850622a77a474a8a1ddaf240965082ee03055bf
faf287257529efa93234ce96fd47d0d43a4884deb7ec54e337bb8ba49b1d12d8
90bca1aee1c83d0c4efc1d89a1c57b991be078a6fcff421495fb9cdbed974c70
b3339675855dc36ef85d78208f43924b6eb62a978caa41971115b13a8c9cd951
03438d007dd69f9021f8c37eb21cd9f817189c99f86e94136b0f6223e07a7366
20aa510e22a6e0abf81a9cdb4491977cc7035ef0f62bf4e97e880688594707a8
ff487e2ea6195cc78c6c3f1d9d23aae0902eec37964143cf85cd425252a0072b
eec4404be651d77865707efa282ec7899a97550ad25351a70a926679f6b34bdf
430ca931fb30ead2352f1f6cc4c832d5e83d0586818e47febd3d9d2dd83950de
e0e7d67763efac156e039e3b9b8e4cf0e269109164788c4901f338f1399699ee
a2e0b264504e6338c455b6227e85273903c8f1f901809eeaaaec9e917ffb09dc
5565d238feb8a0e52f4185f696eac6e4d817d878ca99aab4ab16a341b3c828ed
7a52724e8dd312054edb1fe92f4661be8a4696efe209edfec3f43b7fb8fac3c8
97a1e4bfc76eeec8faa59bd7de85088d2e42cf9562ea66c2305d0309080712ac
68f8a928d8c7b9b1da3ed341ad581da0fadd5bdddf781e0d8831c94553d8d5b3
10eed1464345d7548cbbe6e76ece440f249d9daf5bf13f973f68136d986c7fe5
99e2fcc17330e0e1d8e31c814d659c4a00110a6da389102e22a25eedae3933b2
cb9c62c96c1409b6151ec4cdcda1b0750a13dd61352ca9ed91382a978cc8bba0
7f7219150a44e397a72f82fe9c4232887e991f0b3f0469c29d5cd2b8e3f3d0a7
1f73dccfdf8ee9cb8fb841e40c88a7b124cd28c0b06688eaf2bb81ef4f4ac0aa
c75134c43e97b75bca4ced11b721253c5774cb0a78184acdc5c55580aa07df85
ad3517d5640b93e40bc1e839f6616222801d06dd83ed5887462a71f3858f5b40
941559a78b6e1caf39212048e7f62723e5f283d1942858cc07a339d6d6b24362
59e8919a70ecf74746e7bac52469b520a8a4fa929e8fa8171e22342d8dc4e1d6
b3c12cee79f27bba7b9d58c690083d38170fac66c70ab18dd5897bf0268fc114
e9be7f50bd810d3b8a459a54c2310b567dd7065cb52803306cc5e6132eb9e12f
2b1c8e28590c81630fe3c284857734161139c1998cdd28e899cd1049bf5fff0d
20b88c89c50d71a77a0f2e1007a39cdb0b78f44c8507d3b492e8875a44861279
25cc6ca776e3d36b9aa29c331b522f23f1b309398372089d51297ff179a51bb6
853b91e9b020663d17ecc679445126b293adf51dab2791e846c31adf4fbb232a
2f7226f97fc49d8e893e80ff5e3e1127d0ae76650045dbf30c36ddd0535c0af1
8c511dab54355d76edfda60811e62b832f7593919b5c8f683b53bf6690bc808b
2ed7941c78a8b93373502b3b638392b1981785718e31bbbcca4f251d6b21f535
fb98e235d9cd58d96ab4d3389fdacfff82beda19357f313fabd95729bc984ee1
2fc60266d45774d861a84e932cb572f683a5c140406a6709adb10a08e5391b9b
2843e5be520970bc04d4c2d1d64749c730cd115037cd11b10a5c4073f001ad7a
ea245dfb5adebf5c9635d41f7e92c9194f6a20f900d9bcb14b8931501f0bd411
4da351698b0432b56b06b8bdd26fb7103b973a7c70bf666cc1a26e13fd2585bb
29d5ec780d5e5c02484ba41f291e35d29910e0ea2221c48f2ba19c9be746b8a7
602c89f6771cab55f5ec65aeaff614585d4cde2ff38f5751ca52fd062e871d19
0e52d5414536fce593aada88c26086af95af6b44d700b70315f4fdd9feb0b093
b21d51c3a5519c6e41de9ef4e4bbdb821f2d76f6cc1e2b01d0a0fae37723f25b
f687ef7cfbf2fefbfb85644f57319e28c04f9feed590a317056fef8c130c092f
d16be68a77facd56c4553aff3be893308c986f726619cd0785b5cf8cd5993f88
2c94e0937726b8c53f46350c17b50abb816f720708055e92a097c796a9970f01
265047bb3b17c31db8680e5dc97255cfc147e02f730db48a6852cf403033ea69
933e3e0bf29c5545bb4ea400f0ad62be69b957475e82a6bc8ce3c2a44622d4b0
71e061da69a80307913e97800c500938e1aa6eadde0fd25758b9b394ed1532e9
ff67a4429b3cd257a8ef58dbbc90450eda82271ef4256ba1dc5fa6eb215fedec
2f0ae3872ddb72b9c17060aa7608559a5cd92d376dfc88441ff8c54e6f1a65dc
9bb11533ca7287474f25da8cd5ad24afacc6b66175798298c6924035b9b3f92d
ee0176357d58650cedb8212e95249b9ac0e17145587e398a344c03ad95334618
4c17a091bd4bc5abea728c7245ec9c15fb98693e661bc6ec20239b91db33faa8
8024fb977a8ce280bd9bbe8984c2a1eb02a39c82222940de7b8951fc1493cd80
8b83d463c4ddfc873ac4954f326d473cd6aa3443617fdba8860680188500def6
69b4c8361199937a0cb7e28c689e3dfa2967af5dc5ed0c1fccd770273cc3c71a
0f22c8a761d26fc6db2f20b2c3070269bf8248eebc03743250da0805ee9a8511
183c72638416f3649f30da841ff7a88d29f6cf22f393db7a96407e939b9c6647
SH256 hash:
6acc5d6df27e7a7c84a02305b36188873a3fc0c9cefcbecb82af0c6a1609047c
MD5 hash:
20d04d15be1f8344803d537c208844a4
SHA1 hash:
965b5b2bad3428cb11b1988247b6c593d64e6a3e
Link:
https://www.unpac.me/results/41400a1b-1bac-46fb-8b43-72f72ae14284/
SH256 hash:
5ec939502efe6ca7cf9a9b90111a1c6f458feb06a85890ec26edfced376eb16b
MD5 hash:
2b4619a5b354bca00bbdecd231fd4847
SHA1 hash:
40bae1216cc7fc8abf753a1c4ea739d49b18a237
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/41400a1b-1bac-46fb-8b43-72f72ae14284/
SH256 hash:
d8247e67b46e7bc5e1325068a5e3cae80542f9417ce6b85ee49012dcbf0d22f8
MD5 hash:
f50a5c41865b2297a73a0dd94ebcfcae
SHA1 hash:
00af2a07bd849cbd728520d9bef769428c64acc5
Link:
https://www.unpac.me/results/41400a1b-1bac-46fb-8b43-72f72ae14284/
SH256 hash:
db20bf3295f1aae23ce386ffb850622a77a474a8a1ddaf240965082ee03055bf
MD5 hash:
722c821ad39dfa881452827cf5012955
SHA1 hash:
fcb43bf83d5450d7d9e67624b3f402412ab817ac
Link:
https://www.unpac.me/results/41400a1b-1bac-46fb-8b43-72f72ae14284/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/db20bf3295f1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/db20bf3295f1aae23ce386ffb850622a77a474a8a1ddaf240965082ee03055bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe db20bf3295f1aae23ce386ffb850622a77a474a8a1ddaf240965082ee03055bf

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments