MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb
SHA3-384 hash: 56bfa9b4f7ed8825be02100f1fa9f2edcd04a49120265208491ef50b8f3a9b03252eb5c2cd5da64f03a7723053f48126
SHA1 hash: bb9a0be6d088074fcb7e337c2fc307d3e6c55e6f
MD5 hash: f73a0429aba2fa8576b1edca14dddb2b
humanhash: lamp-november-magnesium-cola
File name:10353690.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:745'472 bytes
First seen:2023-07-10 13:25:03 UTC
Last seen:2023-07-10 14:08:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:EJ4ahp7tL+NA+KDGunXu+94GawKTgN0DpYOt8GlrfQw53MLcFmK5H2/x8H1w:Up5SKDGueoogN0DaOt5lrfQwpAD
Threatray 4'722 similar samples on MalwareBazaar
TLSH T17DF4011671BBAB16CAB9B3FE1544694437F89A0D9930F3181C8B52F7197AF040684FEB
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
277
Origin country :
US US
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
10353690.exe
Verdict:
Malicious activity
Analysis date:
2023-07-10 13:27:33 UTC
Tags:
rat agenttesla
Link:
https://app.any.run/tasks/cd9b3c50-53a0-4f88-bf1c-de9a794c3902

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/413788/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.18937.30081.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Win32.PWSX-gen.17796.10465.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Launching a process
Restart of the analyzed sample
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/64ac06b582e04d158394bc2a/reports/d49de749-6de3-4a43-a659-0081bc83ee5d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ef689df4-ea3d-4abc-b06c-de0569c9e7d6
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1269799
Behaviour
Behavior Graph:
n/a
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-07-10 09:51:40 UTC
File Type:
PE (.Net Exe)
Extracted files:
27
AV detection:
24 of 37 (64.86%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ohjjvheazh45aw4ew7wjksyzwyfubvshlz2bn6ts3wfthan6k5q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3625699aceef8218cece58914659f6ba003e6f26ad033645ed738b4972050aa5
AgentTesla
8866f6c589741b658ffd084aa66e2ef4b34f84b40238e7d60e2acc5961cf207c
AgentTesla
940452c26b4fd683f1c88746b751d4299e9b8c3fe25aa62168eca31924c17592
AgentTesla
c13d10d9eb5505c91c1982dd55019f8d5e5121952be774dc80eff344453c50ea
AgentTesla
d48d95e1122c76273ab844798f1a6896ee0aa2829cb889208789bdb24e72e72d
AgentTesla
e759e4e0ba6d3e577ba3dc31a6ff4af77779a92afef0a7dd1814d23b7fe3ed03
AgentTesla
eb4b358d784a43733f3b307b562f7d3282cc07d94be7526cd8600bf8a4bee530
AgentTesla
f47b5a1548d7d1ecf22e19ea995bb81111132ab5543037903f59acc83316fa1c
AgentTesla
+ 4'712 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230710-qnz1vsaf66/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
a244c825eb008d7aa1da740409108032c01348838c6235a90e54671873daacb0
MD5 hash:
214bbaab9c1082e8f402fc8b42d3b7d4
SHA1 hash:
f709fd14e9e65b919af60d5c2cb7f804b993ccc7
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
SH256 hash:
05aec629dc27cf686a10ff2dafa1dd8969ccc25c27a3fabe6d7ead88c05e5dfc
MD5 hash:
2e44bcd76808919ddaff1043f3ca0574
SHA1 hash:
188c19f44f150bdc5c723cd7a2e337de60c58c3b
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
Parent samples :
f47b5a1548d7d1ecf22e19ea995bb81111132ab5543037903f59acc83316fa1c
e759e4e0ba6d3e577ba3dc31a6ff4af77779a92afef0a7dd1814d23b7fe3ed03
db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb
60755b9a1273f9dc3834df3111a64542a47ea1cb334aa95ae4515476a8b048da
89838c428e6292848d7e8345eee67d50c664b078751c74d7f3db20ebca31c675
069c1a556943461282bfbf8411afc6213a359df9ce4894a80881e45a2ba9bc84
SH256 hash:
a244c825eb008d7aa1da740409108032c01348838c6235a90e54671873daacb0
MD5 hash:
214bbaab9c1082e8f402fc8b42d3b7d4
SHA1 hash:
f709fd14e9e65b919af60d5c2cb7f804b993ccc7
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
SH256 hash:
05aec629dc27cf686a10ff2dafa1dd8969ccc25c27a3fabe6d7ead88c05e5dfc
MD5 hash:
2e44bcd76808919ddaff1043f3ca0574
SHA1 hash:
188c19f44f150bdc5c723cd7a2e337de60c58c3b
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
Parent samples :
f47b5a1548d7d1ecf22e19ea995bb81111132ab5543037903f59acc83316fa1c
e759e4e0ba6d3e577ba3dc31a6ff4af77779a92afef0a7dd1814d23b7fe3ed03
db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb
60755b9a1273f9dc3834df3111a64542a47ea1cb334aa95ae4515476a8b048da
89838c428e6292848d7e8345eee67d50c664b078751c74d7f3db20ebca31c675
069c1a556943461282bfbf8411afc6213a359df9ce4894a80881e45a2ba9bc84
SH256 hash:
a244c825eb008d7aa1da740409108032c01348838c6235a90e54671873daacb0
MD5 hash:
214bbaab9c1082e8f402fc8b42d3b7d4
SHA1 hash:
f709fd14e9e65b919af60d5c2cb7f804b993ccc7
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
SH256 hash:
05aec629dc27cf686a10ff2dafa1dd8969ccc25c27a3fabe6d7ead88c05e5dfc
MD5 hash:
2e44bcd76808919ddaff1043f3ca0574
SHA1 hash:
188c19f44f150bdc5c723cd7a2e337de60c58c3b
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
Parent samples :
f47b5a1548d7d1ecf22e19ea995bb81111132ab5543037903f59acc83316fa1c
e759e4e0ba6d3e577ba3dc31a6ff4af77779a92afef0a7dd1814d23b7fe3ed03
db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb
60755b9a1273f9dc3834df3111a64542a47ea1cb334aa95ae4515476a8b048da
89838c428e6292848d7e8345eee67d50c664b078751c74d7f3db20ebca31c675
069c1a556943461282bfbf8411afc6213a359df9ce4894a80881e45a2ba9bc84
SH256 hash:
a244c825eb008d7aa1da740409108032c01348838c6235a90e54671873daacb0
MD5 hash:
214bbaab9c1082e8f402fc8b42d3b7d4
SHA1 hash:
f709fd14e9e65b919af60d5c2cb7f804b993ccc7
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
SH256 hash:
05aec629dc27cf686a10ff2dafa1dd8969ccc25c27a3fabe6d7ead88c05e5dfc
MD5 hash:
2e44bcd76808919ddaff1043f3ca0574
SHA1 hash:
188c19f44f150bdc5c723cd7a2e337de60c58c3b
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
Parent samples :
f47b5a1548d7d1ecf22e19ea995bb81111132ab5543037903f59acc83316fa1c
e759e4e0ba6d3e577ba3dc31a6ff4af77779a92afef0a7dd1814d23b7fe3ed03
db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb
60755b9a1273f9dc3834df3111a64542a47ea1cb334aa95ae4515476a8b048da
89838c428e6292848d7e8345eee67d50c664b078751c74d7f3db20ebca31c675
069c1a556943461282bfbf8411afc6213a359df9ce4894a80881e45a2ba9bc84
SH256 hash:
db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb
MD5 hash:
f73a0429aba2fa8576b1edca14dddb2b
SHA1 hash:
bb9a0be6d088074fcb7e337c2fc307d3e6c55e6f
Link:
https://www.unpac.me/results/0c2daef3-906e-4ce5-aade-6a204c392836/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/db8e94d4e406/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip fea22e9d19fb68b4e6f6534dfcbb0668a5bf3044ebcff5337f45376ba98b8a40

AgentTesla

Executable exe db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb

(this sample)

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/413788/
  
Dropped by
SHA256 fea22e9d19fb68b4e6f6534dfcbb0668a5bf3044ebcff5337f45376ba98b8a40
  
Dropped by
MD5 7a58585362099b271f501e67dfe8e7d6

Comments