MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de8e6844d70025d74f5d6fa8102f1bef0558cb4c27933e89b33c9bc73b6f11d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de8e6844d70025d74f5d6fa8102f1bef0558cb4c27933e89b33c9bc73b6f11d9
SHA3-384 hash: d51618993ffb229bb34158fb66e27e83ac0b6d2375df36d397419522175df54e4e0151e2e5e5fe17f968135d905e6bbd
SHA1 hash: b5935e305b5de02673fe7badb5be1a7d888ca089
MD5 hash: edc8259bd38c84b39d54955539280455
humanhash: happy-california-tango-freddie
File name:Invoice.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:5'632 bytes
First seen:2023-10-02 10:54:36 UTC
Last seen:2023-10-02 13:30:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 96:dKYXbxg4TjtRIV45w8Jd0/Affc4PTMVzNt:E6mKtRIV43v0/AfrYv
Threatray 5'645 similar samples on MalwareBazaar
TLSH T18AC1C51593E8B633D9A34735FC6393440235E2518A57DFAF7984210F2E263684E72B72
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter cocaman
Tags:AgentTesla exe Shipping

Intelligence

File Origin
# of uploads :
4
# of downloads :
300
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
Invoice.exe
Verdict:
Malicious activity
Analysis date:
2023-10-02 12:07:10 UTC
Tags:
stealer agenttesla
Link:
https://app.any.run/tasks/46c3d09d-a05e-4cc8-8950-d7e589f8a106

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/452599/
Detection(s):
Sanesecurity.Rogue.0hr.20231002-1239.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending an HTTP GET request
Creating a file in the %AppData% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Sending a custom TCP request
Reading critical registry keys
Creating a window
Query of malicious DNS domain
Sending a TCP request to an infection source
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/651aa188f1b40cb0d625dda9/reports/a5e87114-dff5-411f-9e3d-6ad253d45562/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/de8e6844d70025d74f5d6fa8102f1bef0558cb4c27933e89b33c9bc73b6f11d9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/c7322cf4-25f3-4160-9d1c-6733c179fdb4
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1317865
Signature
.NET source code contains potential unpacker
Contains functionality to log keystrokes (.Net Source)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample has a suspicious name (potential lure to open the executable)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1317865 Sample: Invoice.exe Startdate: 02/10/2023 Architecture: WINDOWS Score: 100 53 Multi AV Scanner detection for domain / URL 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 7 other signatures 2->59 6 Qrasau.exe 14 5 2->6         started        10 Invoice.exe 16 5 2->10         started        13 Qrasau.exe 2->13         started        process3 dnsIp4 29 92.118.112.4, 443, 49795 GUDAEV-ASRU Russian Federation 6->29 61 Multi AV Scanner detection for dropped file 6->61 63 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->63 65 May check the online IP address of the machine 6->65 67 Machine Learning detection for dropped file 6->67 15 Qrasau.exe 2 6->15         started        31 qu.ax 92.118.112.119, 443, 49792, 49805 GUDAEV-ASRU Russian Federation 10->31 27 C:\Users\user\AppData\Roaming\Qrasau.exe, PE32 10->27 dropped 69 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 10->69 19 Invoice.exe 2 10->19         started        21 Invoice.exe 10->21         started        23 Invoice.exe 10->23         started        25 Qrasau.exe 13->25         started        file5 signatures6 process7 dnsIp8 33 104.237.62.212, 443, 49796 WEBNXUS United States 15->33 35 192.168.2.1 unknown unknown 15->35 37 api.ipify.org 15->37 39 api4.ipify.org 64.185.227.156, 443, 49793, 49807 WEBNXUS United States 19->39 41 premium89.web-hosting.com 63.250.38.2, 49794, 49797, 49808 NAMECHEAP-NETUS United States 19->41 43 api.ipify.org 19->43 45 api.ipify.org 25->45 47 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 25->47 49 Tries to steal Mail credentials (via file / registry access) 25->49 51 Tries to harvest and steal browser information (history, passwords, etc) 25->51 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/de8e6844d70025d74f5d6fa8102f1bef0558cb4c27933e89b33c9bc73b6f11d9/
Threat name:
ByteCode-MSIL.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2023-10-02 09:04:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=32hgqrgxaas5ot25n6ubaly354cvrs2me6jt5cnthsn4oo3pchmq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0331ca586f68e8a853e9030635f249dba8337da5ef7c29521c373807fcce1a6f
AgentTesla
113e16425e010952150f3c1f7ae615602cd4ca30826b0e7518aa058341058a94
AgentTesla
59b1624b294226b93b186dc503efd7c48937542eec03b0d32d27034729c2a733
AgentTesla
984be8706b65a53d26f032b9471751943cbf5e35d8c4baabcac153053949e283
AgentTesla
c5de366fb77c67ffc4f8daa348f10e4dbd9e68287427943c25a7112b467b89eb
AgentTesla
c6a0026a78d283724646d2cd5db9fa459a0bd306e19e50c6c23826603b6438df
AgentTesla
d5252b71a90d3ef290ff4a760b8cd4ec847feac8d5737eed43728bca34b2068b
AgentTesla
d85278c4099b913c69779c4b69a0c85cbb0d7cbe72ae9a324b798a0fd2e02fb7
AgentTesla
ed5d871ea2afdbdd66a20e04f156f2ecb0fa56e929aaeaa65779e37a13852e20
AgentTesla
+ 5'635 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence spyware stealer
Link:
https://tria.ge/reports/231002-mz4xeaba62/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
de8e6844d70025d74f5d6fa8102f1bef0558cb4c27933e89b33c9bc73b6f11d9
MD5 hash:
edc8259bd38c84b39d54955539280455
SHA1 hash:
b5935e305b5de02673fe7badb5be1a7d888ca089
Detections:
PureCrypter_Stage1
Create hunting rule
Link:
https://www.unpac.me/results/2d768bdb-d435-4297-acca-576f205ab9ef/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/de8e6844d70025d74f5d6fa8102f1bef0558cb4c27933e89b33c9bc73b6f11d9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a733d8c10f838ace961b14c50ef4dc70d02b18ecd63ebfb7f8055af593f4bbc4

AgentTesla

Executable exe de8e6844d70025d74f5d6fa8102f1bef0558cb4c27933e89b33c9bc73b6f11d9

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 a733d8c10f838ace961b14c50ef4dc70d02b18ecd63ebfb7f8055af593f4bbc4
Cape
Cape
https://www.capesandbox.com/analysis/452599/
  
Dropped by
MD5 355e92db47c830f495fcf5cdd8d94586

Comments