MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db7d96f8ee567f9358b4746b7d2ee4d39c66cb2854ddfbe80ac2d878caf1b132. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 19

Intelligence 19 IOCs YARA 10 File information Comments

SHA256 hash:	db7d96f8ee567f9358b4746b7d2ee4d39c66cb2854ddfbe80ac2d878caf1b132
SHA3-384 hash:	2447715c5da1d4c70d04466673affa14a820f8cda820cddec34b600637ccf2c8a4855b09bf0cb89dcf933fc002b03302
SHA1 hash:	8327cf1ce6a1125c0ff17ec496e695ab90f7afcd
MD5 hash:	a6c38f90bab12e5ccb14cd079aa1369e
humanhash:	nineteen-nebraska-march-spaghetti
File name:	NEW REQUEST ORDER NO 202408709001 PDF.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	661'512 bytes
First seen:	2024-09-22 14:01:35 UTC
Last seen:	2024-09-22 14:27:59 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:w/5s/qjqYBXov753GyjEHLiKlw6xQbwMTAw61EuR1y/57pt+wxkR:wkpUXov753DEHLiKlw6x+iWy1Y7pt+3
Threatray	1'637 similar samples on MalwareBazaar
TLSH	T1ACE4228A1EE46721EBB95BF94677213193B272272511C3480CD1A1CB6E77FD8CB0692F
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
File icon (PE):
dhash icon	86a6fa6eea82dc18 (4 x Formbook, 3 x AgentTesla, 1 x SnakeKeylogger)
Reporter	abuse_ch
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

380

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

NEW REQUEST ORDER NO 202408709001 PDF.exe

Verdict:

Malicious activity

Analysis date:

2024-09-22 14:10:34 UTC

Tags:

evasion smtp exfiltration stealer agenttesla

Link:

https://app.any.run/tasks/b62779ce-c3ae-4e97-92fd-a1559f1d8a9b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.Packed2.47985.24916.21372.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66f0235f8aca58c2b2c6b9bc

Tags:

Discovery Encryption Infostealer Network Static Stealth Gensteal Agenttesla Lien

Result

Verdict:

Malware

Maliciousness:

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lolbin masquerade overlay packed shell32 vbnet

Link:

https://www.filescan.io/uploads/66f0235dbb9fe02b41b565fd/reports/b8c73a66-a2bf-4c61-bbf0-78296b3ccb49/overview

Verdict:

Malicious

Labled as:

Jalapeno.Generic

Link:

https://www.hybrid-analysis.com/sample/db7d96f8ee567f9358b4746b7d2ee4d39c66cb2854ddfbe80ac2d878caf1b132

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2f74fe6b-d9db-41ef-b591-7f0b08727f21

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1515359

Signature

.NET source code contains potential unpacker

AI detected suspicious sample

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/db7d96f8ee567f9358b4746b7d2ee4d39c66cb2854ddfbe80ac2d878caf1b132

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/db7d96f8ee567f9358b4746b7d2ee4d39c66cb2854ddfbe80ac2d878caf1b132/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2024-09-20 21:00:41 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

28 of 38 (73.68%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3n6zn6hokz7zgwfuorvx2lxe2oognszikto7x2akylmhrsxrweza._file

Verdict:

malicious

Label(s):

agenttesla

agenttesla_v4

unknown_loader_037

AgentTesla

77ca4ee4e11265fae0cb39bd6ebbaca1e771411098fdd5c11a4ad6eb73b1a85c

AgentTesla

c39033fb9aa3af73b672cd1784036e84a3bb20d7cb8d2dd612208bdd5b96d622

AgentTesla

db7d96f8ee567f9358b4746b7d2ee4d39c66cb2854ddfbe80ac2d878caf1b132

AgentTesla

dbda8c6ed6803fd8eeb547a60ee600c101315b478fa055d4a1d0ac438fc45527

AgentTesla

+ 1'627 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla credential_access discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/240922-rb4zqashqm/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

System Location Discovery: System Language Discovery

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Credentials from Password Stores: Credentials from Web Browsers

AgentTesla

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/9b427844-007f-43d4-8a70-45638893077b

Unpacked files

SH256 hash:

d1f4761e2e1e15fe454a70864c3aa1da7d6dc90582222bbd7e6d53d0bbee6f62

MD5 hash:

b08a9c9cb485bd7567bf062922a1e897

SHA1 hash:

3b5781fb115d06bdede80cb6ff627fde1a50d9f5

Link:

https://www.unpac.me/results/602a736c-acc5-4f8e-ab8c-1f9338d2b76e/

Parent samples :

e0c6754a29f3aae510a03bbfc2f03a576fa27bdb4915b35649b357912606fffa
b222db5c481e3e1421f07bd35fe5022b912d3e70214c254a00d9e8ec5c382987
2da496c1cdddd81ca1e452eacc38596132cb62883d8b568ee55e2524a054facd
c30bcd2377714775a591adfba9ffcbc833f646bf9669829acf1d0dd0c07e030d
9c7df3a3e8174fcad51ce98aa8875fd72b8e7acadb309ad8b6ac59e8a0c1d65d
39454a1ce8c389d837bb510efe44858712813fd3ef611822af3a1e5b0f64f52a
b4ea9fc8891fce7e255d583efa962256b0dee44df2de28f0e4d4ae8145f0ca5a
019c0bda2cdb00d88ddd70fae9c57490c14b218aa3c2e9f383f75fa415c03168
00bebcf6a27277b5060ea1264725f496a99b7e5d06649e6e8c9c8ad24055ec61
0787749d9897612314975e2943139157efcff4dbf604323d3d950c76b7555719

SH256 hash:

ba5c6ddbc355197232aaee9fbc7043f17a5419fcf644184bd7f11cebf85eab7b

MD5 hash:

47341ea81fe9a902f4b10ecfc9e69ccf

SHA1 hash:

18495a225b1952b086aa71e27f5fb99795e52b69

Detections:

AgentTesla

win_agent_tesla_g2

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Agenttesla_type2

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Link:

https://www.unpac.me/results/602a736c-acc5-4f8e-ab8c-1f9338d2b76e/

Parent samples :

c62267c0ef0af138ffca07372e24e4fb0681d0f1b87bfe798a33a14265791985
744daca400af1f5721eaa529ec3fe427e4837e17ff4766f6bb39643aa488bfee
4e1b00dd1374c6d922e8a141562bbf88f69961e3034a6158007cf2ced5c31c62
df42aed98863b49a6f208ef3181f08ba5014cc3192c3a406dad6def44e4a3c14
f9ae0d40d4f2b88956a1ccfe6cff9aae6a36508574a56595c331d7ca207e5f03
9f1106f2ccae0b0bec34ba75bfc0dbd38367d2e361ab2aebcbf261791925ca64
d2f50ffb5f06255d27d26243697529f4a41772bd2b8de1cd0ba605f10baccd50
8ed8b891d4aa6f1b7935ec3c298d781403c4ba67b1f8e2e6cc7076b7c94a15ce
8dc055b7b9e0b9a68c9ad2a0305410a75b0ea3dc441c60a3acf44cce47415fc1
25512e04d8b4608cc9b3018d5315cd2645a78c18f62b198a012e9e562efde2ad
db7d96f8ee567f9358b4746b7d2ee4d39c66cb2854ddfbe80ac2d878caf1b132

SH256 hash:

7facc6139f1c310244145a7c6142a5f9904287664e8458c7fd9fc397cca48a64

MD5 hash:

e80647530f54993bd18d13afcc4919a6

SHA1 hash:

0a54ef8dd1ba8c964024f5183fcee45c367c12f4

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/602a736c-acc5-4f8e-ab8c-1f9338d2b76e/

SH256 hash:

db7d96f8ee567f9358b4746b7d2ee4d39c66cb2854ddfbe80ac2d878caf1b132

MD5 hash:

a6c38f90bab12e5ccb14cd079aa1369e

SHA1 hash:

8327cf1ce6a1125c0ff17ec496e695ab90f7afcd

Link:

https://www.unpac.me/results/602a736c-acc5-4f8e-ab8c-1f9338d2b76e/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/db7d96f8ee56/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/db7d96f8ee567f9358b4746b7d2ee4d39c66cb2854ddfbe80ac2d878caf1b132

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_APT29_WINELOADER_Backdoor Create hunting rule
Author:	daniyyell
Description:	Detects APT29's WINELOADER backdoor variant used in phishing campaigns, this rule also detect bad pdf,shtml,htm and vbs or maybe more depends
Reference:	https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample