MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db4298e6b1ab62b76c39dbedd3bedcef513acf96a75cc97eabf9f82741027ea5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 14

Intelligence 14 IOCs YARA 2 File information Comments 1

SHA256 hash:	db4298e6b1ab62b76c39dbedd3bedcef513acf96a75cc97eabf9f82741027ea5
SHA3-384 hash:	edbecd19c2d974999842a1a7225d06e6e30ec6c9db752583454350077e028254add8617d9b6cc306c503e4e035319f0a
SHA1 hash:	ec47aaeeaf8486b179a9ec4760c1117ebe70463d
MD5 hash:	9f8754468af5e3d4761c579ec5341038
humanhash:	cola-eleven-low-beryllium
File name:	9f8754468af5e3d4761c579ec5341038
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	995'840 bytes
First seen:	2023-07-03 09:02:29 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:n/nqGweHLRY5njPgov04ytzeCpCB5/M02ydkHF7Eq+P8SbkwmBAQ8:niGwGLRmlJBb5vdZfkdw/
Threatray	4'455 similar samples on MalwareBazaar
TLSH	T1FA2594BD294022A7947DE562C2510B4AF23B6C1FB2134D6B2ED217C5862E41E7BEDC1F
TrID	63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	zbetcheckin
Tags:	32 AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

267

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

Amendment Swift Copy.xls

Verdict:

Malicious activity

Analysis date:

2023-07-03 08:12:59 UTC

Tags:

exploit cve-2017-11882 loader agenttesla

Link:

https://app.any.run/tasks/ffde1b87-b824-4c7c-ac33-7b7b55baf9b5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/405803/

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.10703.7952.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Launching a process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

comodo packed

Link:

https://www.filescan.io/uploads/64a28ecc204315fbc16c6f44/reports/14c5d894-746a-4d51-8b13-edad0fb935df/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/db4298e6b1ab62b76c39dbedd3bedcef513acf96a75cc97eabf9f82741027ea5

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7d028e0b-87ce-43ef-8988-fc34d53257e4

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1265681

Signature

.NET source code contains very large strings

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/db4298e6b1ab62b76c39dbedd3bedcef513acf96a75cc97eabf9f82741027ea5/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-07-03 08:23:30 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3nbjrzvrvnrlo3bz3pw5hpw455itvt4wu5oms7vl7h4coqicp2sq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

2be71dbd5717aadd41efe306affff9fb63675adb1dd4f1a5a7b5d123c4ba508b

AgentTesla

3e1f623f0b2c1b85bcbca396bbeb79e06db39138a004c14201827ed1a8ca377a

AgentTesla

7cae209399f08c5a85de444babd258aadb253b625356dcd47e4ccf4fca8a013e

AgentTesla

84c7973871a6a639c40534f9e3fd7135bd35cd1b0eee937cc849af90c903c4c2

AgentTesla

a9adeec302ab071989a321a13b0c9b1f12e4c0fd69f3dab0a99e46d165a40cd3

AgentTesla

c45219a3fd0cf51360c30b7aa0cba985ad1d28030785ab9dc5083090540409d8

AgentTesla

+ 4'445 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230703-kz15eaha6x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AgentTesla

Unpacked files

SH256 hash:

5160103db015503908ab51fabcc155bf264985231f0c78c7728ca9a6329e935c

MD5 hash:

be1ec7e8963d72eb817c473d38a9aa8d

SHA1 hash:

d399f2c59c5768e3c65fe4201e72a0474dc673dd

Link:

https://www.unpac.me/results/95a2af63-27f9-4480-8d41-72779cdb7bb5/

SH256 hash:

a7e471f7bc560488312d57e885bb4cfc423587a0d84abbb3073a820f7cd0e209

MD5 hash:

e7709a907be0cdb6ff7eb99daee97c6c

SHA1 hash:

bb3f6871c40f54070b53947bf6958d410ea8bac1

Link:

https://www.unpac.me/results/95a2af63-27f9-4480-8d41-72779cdb7bb5/

SH256 hash:

f5f0576064260ca8994961e9bac29e51ad52cc7473d52f1379d5c533a40beae3

MD5 hash:

b2ed9276e6686711ed5ec6a3a1342147

SHA1 hash:

533064433d0a15f8a28f79bbe8b8ea5b5ad37ffd

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/95a2af63-27f9-4480-8d41-72779cdb7bb5/

Parent samples :

cb3964a3b6a2ee8bd2bdbc3a3b65306546cecec2deb444968ee8f33ce2c1a593
2be71dbd5717aadd41efe306affff9fb63675adb1dd4f1a5a7b5d123c4ba508b
c45219a3fd0cf51360c30b7aa0cba985ad1d28030785ab9dc5083090540409d8
3e1f623f0b2c1b85bcbca396bbeb79e06db39138a004c14201827ed1a8ca377a
a9adeec302ab071989a321a13b0c9b1f12e4c0fd69f3dab0a99e46d165a40cd3
2406e6d5ca634a5b588ee4bd967cc1ac4ace9e24ac4761471c992f4a1450469f
7cae209399f08c5a85de444babd258aadb253b625356dcd47e4ccf4fca8a013e
db4298e6b1ab62b76c39dbedd3bedcef513acf96a75cc97eabf9f82741027ea5

SH256 hash:

5160103db015503908ab51fabcc155bf264985231f0c78c7728ca9a6329e935c

MD5 hash:

be1ec7e8963d72eb817c473d38a9aa8d

SHA1 hash:

d399f2c59c5768e3c65fe4201e72a0474dc673dd

Link:

https://www.unpac.me/results/95a2af63-27f9-4480-8d41-72779cdb7bb5/

SH256 hash:

a7e471f7bc560488312d57e885bb4cfc423587a0d84abbb3073a820f7cd0e209

MD5 hash:

e7709a907be0cdb6ff7eb99daee97c6c

SHA1 hash:

bb3f6871c40f54070b53947bf6958d410ea8bac1

Link:

https://www.unpac.me/results/95a2af63-27f9-4480-8d41-72779cdb7bb5/

SH256 hash:

f5f0576064260ca8994961e9bac29e51ad52cc7473d52f1379d5c533a40beae3

MD5 hash:

b2ed9276e6686711ed5ec6a3a1342147

SHA1 hash:

533064433d0a15f8a28f79bbe8b8ea5b5ad37ffd

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/95a2af63-27f9-4480-8d41-72779cdb7bb5/

Parent samples :

SH256 hash:

5160103db015503908ab51fabcc155bf264985231f0c78c7728ca9a6329e935c

MD5 hash:

be1ec7e8963d72eb817c473d38a9aa8d

SHA1 hash:

d399f2c59c5768e3c65fe4201e72a0474dc673dd

Link:

https://www.unpac.me/results/95a2af63-27f9-4480-8d41-72779cdb7bb5/

SH256 hash:

a7e471f7bc560488312d57e885bb4cfc423587a0d84abbb3073a820f7cd0e209

MD5 hash:

e7709a907be0cdb6ff7eb99daee97c6c

SHA1 hash:

bb3f6871c40f54070b53947bf6958d410ea8bac1

Link:

https://www.unpac.me/results/95a2af63-27f9-4480-8d41-72779cdb7bb5/

SH256 hash:

f5f0576064260ca8994961e9bac29e51ad52cc7473d52f1379d5c533a40beae3

MD5 hash:

b2ed9276e6686711ed5ec6a3a1342147

SHA1 hash:

533064433d0a15f8a28f79bbe8b8ea5b5ad37ffd

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/95a2af63-27f9-4480-8d41-72779cdb7bb5/

Parent samples :

SH256 hash:

db4298e6b1ab62b76c39dbedd3bedcef513acf96a75cc97eabf9f82741027ea5

MD5 hash:

9f8754468af5e3d4761c579ec5341038

SHA1 hash:

ec47aaeeaf8486b179a9ec4760c1117ebe70463d

Link:

https://www.unpac.me/results/95a2af63-27f9-4480-8d41-72779cdb7bb5/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

exe db4298e6b1ab62b76c39dbedd3bedcef513acf96a75cc97eabf9f82741027ea5

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2675864/

Cape

https://www.capesandbox.com/analysis/405803/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-07-03 09:02:30 UTC

url : hxxp://85.217.144.61/sss.exe