MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db6d0d7d8fbb083af05032fa8d3d516cf789f2f81fc651749e77bb4f7ba4e5ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db6d0d7d8fbb083af05032fa8d3d516cf789f2f81fc651749e77bb4f7ba4e5ee
SHA3-384 hash: cdaa293bbf28e8b0d7433376429e349f2f421a56cdc423f9ab98858b914eec9edaca941210f6e0a45d0a6b9a9d0ef197
SHA1 hash: f75be774f9c89f5b25013aa800d113efefe4a30e
MD5 hash: e9af98b06f66a7426d1f90eac46c6dd1
humanhash: saturn-uncle-mexico-sixteen
File name:Zamowienie_nr_0410236533.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'093'120 bytes
First seen:2023-10-04 10:44:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:IDHNXIiv5uG8BU2yc4u+KfhDhv6joaqYIyCydIJ:wziYqYIti
Threatray 58 similar samples on MalwareBazaar
TLSH T1EA351803BA4786BAE24917F2E59B4C04C361F983731BD70B789E23A615437ABBF46507
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter Anonymous
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
304
Origin country :
PL PL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.11265.22965.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Reading critical registry keys
Creating a window
Setting a keyboard event handler
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/651d422e64965c51f773ddf3/reports/c0bfc45d-ef77-4ce6-b57d-4a203d2ece89/overview
Verdict:
Malicious
Labled as:
MSILHeracles.Generic
Link:
https://www.hybrid-analysis.com/sample/db6d0d7d8fbb083af05032fa8d3d516cf789f2f81fc651749e77bb4f7ba4e5ee
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/13143196-514f-4bed-8ab4-2d2cf5293156
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1319380
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/db6d0d7d8fbb083af05032fa8d3d516cf789f2f81fc651749e77bb4f7ba4e5ee/
Threat name:
ByteCode-MSIL.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2023-10-04 10:45:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
19 of 23 (82.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3nwq27mpxmedv4cqgl5i2pkrnt3yt4xyd7dfc5e6o65u665e4xxa._file
Verdict:
malicious
Similar samples:
007cfdd9d19a225b749811f15daee02016824bfd2fbb63934ff4df18ed59eeff
AgentTesla
086495cde3e89171613dfbc1747b2ecc9d1a810a713d3c49e432ade7bbb61158
AgentTesla
1c754314f04cdcce697edd7ec302173990f645b1cc6e94347a38f543fdc93492
AgentTesla
25d22f62cf2de22eb2c70e2922628e6549374f8b130909ddd9f923cc3a225130
AgentTesla
4894c3f698e1101a02c7af04e0fd81e36a0d91c0ce7c7003234e7bc18906f024
AgentTesla
5c7e18764c02e02117f91213a2f66e63265d3ed30c0ea8ae1c9be8ff5ee4ba43
AgentTesla
7cbe0d24267f2f3b343b4e223cfdbeaf47ce23e2d405d65a72074682b1f56089
AgentTesla
8a6c6cf2621bc864fe773ead086f95b0d95a6d959f0920b59c571242ef5aa126
AgentTesla
+ 48 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/231004-mtc7haah8s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
529117b287563febcc81f67b45107ba409824d0793f64484ae17a7397d7d7140
MD5 hash:
93e955cb7b9c52591cb061958fad2ca2
SHA1 hash:
d6ca5d664775a675b06ae556daf96c6b2e1178a3
Link:
https://www.unpac.me/results/1e7ec8ef-0b79-4ab8-b203-ed1a4334cb12/
SH256 hash:
19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372
MD5 hash:
4e29f75c0c51b9dec76955f0382d9541
SHA1 hash:
4899aa8e3f57339cbaec8faab777897a76fe1c3a
Link:
https://www.unpac.me/results/1e7ec8ef-0b79-4ab8-b203-ed1a4334cb12/
SH256 hash:
41674bf459beb7b80207a386c159443c89c9d2fc4d940765c81de08181250291
MD5 hash:
c1b626d19e0fa2991a184a94980ae54d
SHA1 hash:
3904b1d17a11e989fa9686ff8a0d28808f59c245
Link:
https://www.unpac.me/results/1e7ec8ef-0b79-4ab8-b203-ed1a4334cb12/
SH256 hash:
ed71f3708cd6d6c3801ca64ca461ac02df07c003d53d23354412ad298ade6aa5
MD5 hash:
97338b8a1254d0b1039ed9990ecf7313
SHA1 hash:
1a2f8cbe71c8428c7a8ba094b64ff42f45a59497
Detections:
AgentTesla
Create hunting rule
win_agent_tesla_g2
Create hunting rule
Link:
https://www.unpac.me/results/1e7ec8ef-0b79-4ab8-b203-ed1a4334cb12/
Parent samples :
db6d0d7d8fbb083af05032fa8d3d516cf789f2f81fc651749e77bb4f7ba4e5ee
5c521ac354b4f665c9e5dd53bb28e77da262fda86ddabbd850f67e9c4deb0b3b
0da7dff9f04449e5982ea8496f7ba27651a655578ac19e991ad5e397c005b956
20f0d19cd4ee39f953325c96c984d155124cbf7f165e9427355f25c1eddc6313
57008a87cd574f34005b825703fc301def80f754852ecff3943bd9d2dbdf1cde
SH256 hash:
db6d0d7d8fbb083af05032fa8d3d516cf789f2f81fc651749e77bb4f7ba4e5ee
MD5 hash:
e9af98b06f66a7426d1f90eac46c6dd1
SHA1 hash:
f75be774f9c89f5b25013aa800d113efefe4a30e
Link:
https://www.unpac.me/results/1e7ec8ef-0b79-4ab8-b203-ed1a4334cb12/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/db6d0d7d8fbb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/db6d0d7d8fbb083af05032fa8d3d516cf789f2f81fc651749e77bb4f7ba4e5ee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Windows vault credential objects. Observed in infostealers
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments