MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 def920207a8b0b441f3744dac84c6f67c8f1ba6d84d31a3beeda75ccdf510d85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 16

Intelligence 16 IOCs YARA 8 File information Comments 1

SHA256 hash:	def920207a8b0b441f3744dac84c6f67c8f1ba6d84d31a3beeda75ccdf510d85
SHA3-384 hash:	4b7b7cdd4390919de586944102722ad5a7fe086f335535725013b0c3e37015891f04b6fef8315cc31f3b8b9aa67d5bab
SHA1 hash:	647550b5bd3a60d55de25841ba451f7fba1fc5ca
MD5 hash:	c723224047bd5faa0430b2707e784dde
humanhash:	network-edward-neptune-minnesota
File name:	c723224047bd5faa0430b2707e784dde
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	900'096 bytes
First seen:	2023-09-19 05:18:45 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:J8VkSMdr3GNUAn9cNNeX8X/iTS46omhUgo8Lz0O9lAZBERe6stJQ8bUSzUXiT9Nh:J8yhLzNnAZBJfASoXiN2oYpNwXf
Threatray	5'644 similar samples on MalwareBazaar
TLSH	T19515093530FA2516C373E7E20BD9ADAE9799F237111EF63B348113978652E019AC2736
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	zbetcheckin
Tags:	32 AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

277

Origin country :

Vendor Threat Intelligence

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/449552/

Detection(s):

SecuriteInfo.com.Trojan.DownLoaderNET.710.17950.24005.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/65092f450870810f0181d115/reports/881ff40e-d4c1-4eaa-9988-5b95e8b9872f/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/def920207a8b0b441f3744dac84c6f67c8f1ba6d84d31a3beeda75ccdf510d85

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/afaab88b-5b2f-4dfe-b392-95d7143dde53

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1310524

Signature

.NET source code contains potential unpacker

.NET source code contains very large strings

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/def920207a8b0b441f3744dac84c6f67c8f1ba6d84d31a3beeda75ccdf510d85/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-09-18 16:20:42 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

17 of 23 (73.91%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=334said2rmfuihzxitnmqtdpm7epdotnqtjruo7o3j24zx2rbwcq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

08d58459979cfe17010471396945bb905f18bb29bfbf200b918203d6ee0d1cb4

AgentTesla

485b45513f839ff3c972cbd2434273388b87c070c8c6125a8462aeabe2fb96d5

AgentTesla

4d5bf61908d4cedb7b9f4dc857e4c469f8feb1b7bdb4cd6190c68fe5ed9abeaa

AgentTesla

68d7bd6dc7ce2ada6af865682185e9f2c33c897ec3191f0d6127d3654e69b4a1

AgentTesla

983aa00ee743b167b2ff1e8159844f36d971179fe86ca794405f32d865d0fea7

AgentTesla

9bee15aa43bcdb1c361ba488354de254e7860b9f006ad7ce7602adc6d7667e62

AgentTesla

ef64bf88be50dcedfb18bb1310109a48940ef5e434e3c83b63a7fa6b2a78fe00

AgentTesla

+ 5'634 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230919-fztywafa4x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

4a8d70ece798fb6955e46bdb4b4813924a3bbcf205e585fd0aef148123a44489

MD5 hash:

3bcd5e9d69da03ebe27b9c2e472d9e8d

SHA1 hash:

aa268bd00ed60a5907b4b2a669ddd21a1b8bb4da

Link:

https://www.unpac.me/results/f568c304-7a27-48b1-bc10-af4ec8258bb9/

SH256 hash:

ffedb0011e1683d0fb8f90d31777fcdaa52357de96346e1e867cac35a6e1dd07

MD5 hash:

d5bcccffc50566bbfe65aa3ddd01e690

SHA1 hash:

2f445779115789f2dfc1010efdc2b9d9ffa63e3e

Detections:

AgentTesla

Link:

https://www.unpac.me/results/f568c304-7a27-48b1-bc10-af4ec8258bb9/

Parent samples :

983aa00ee743b167b2ff1e8159844f36d971179fe86ca794405f32d865d0fea7
ef64bf88be50dcedfb18bb1310109a48940ef5e434e3c83b63a7fa6b2a78fe00
08d58459979cfe17010471396945bb905f18bb29bfbf200b918203d6ee0d1cb4
def920207a8b0b441f3744dac84c6f67c8f1ba6d84d31a3beeda75ccdf510d85
af4458dcaccca4a71479eccc4601fe13cd6a9be0c30e793cb6efa2f11b72a2fc
d8adff43a2a1683b04d784d5f4b7718051f949267cd387bb46f9c89ee8df59e0
dfba4399135411a957312b2dd3f743d93adb849a72126f15637f5dc960d39edf
41ba24841b5058d02d56f6e4bd187bd7c9f6ece97f38c682a27bfc26748e4c5f
0be380906ad865eadadd41573bc90cdaa2de6112a075b7c8ea65d94e8531ef6d
cf7d6cbc7a96896a60640f293bb9e3aad591556cbffdab459b2e52f89f89865e
d683eb7b2ffb8b8e7131a4e135273eca2c8c8fe04a20eb76ec079a6266c7b690
80d9718fc98cc049b994f38f0ac711f7b5486597495f37e1f3fdd9b357bd398d
56d8f0df66db808a471212b1255be712064e5fddcb5102e280118fa40154506c
e3c628afe7d88b77e6aca9f99ad0739fe6a7c94f331d53f52ea1f627221700d0
3c3e556a7ff5b9d5d7deb289a9172ee262f0aae4eeba873fd98a6107ec488378
ff1abbabbb45cab609a346d381a3116432c9c85e42afbb051342d779fbad4e80
ed92cfb02cdacf96f67a4a7c97e0f26d37e7349be99aa8fc105bd3a608186e25
78b416d23744ede4c31219d119d9b8687820b5b4d2c692f9071c9850f523e5e1
471cc066a5f5828095b8a36548de488db6b0c06443f2d295cc7268910436eda2

SH256 hash:

784d4e0af30bcca58d54f86b6966e1c147bcc194a99126ebe79538e9084f6d80

MD5 hash:

5caf74e6818e40e82651781613a42425

SHA1 hash:

2a182b1552373e0907bfd03db31120596df994d0

Link:

https://www.unpac.me/results/f568c304-7a27-48b1-bc10-af4ec8258bb9/

SH256 hash:

407a6976a67e7fa1151c5ea43392a40e8f4bacce33123b27f8222fb98736fe2a

MD5 hash:

d376ee12e36f7141fe034df53cc9f30a

SHA1 hash:

218af6e11976c9f5fa7ca186cace1ac07df1ca75

Link:

https://www.unpac.me/results/f568c304-7a27-48b1-bc10-af4ec8258bb9/

SH256 hash:

def920207a8b0b441f3744dac84c6f67c8f1ba6d84d31a3beeda75ccdf510d85

MD5 hash:

c723224047bd5faa0430b2707e784dde

SHA1 hash:

647550b5bd3a60d55de25841ba451f7fba1fc5ca

Link:

https://www.unpac.me/results/f568c304-7a27-48b1-bc10-af4ec8258bb9/

Malware family:

AgentTesla.v4

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/def920207a8b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/def920207a8b0b441f3744dac84c6f67c8f1ba6d84d31a3beeda75ccdf510d85

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	AgentTesla_DIFF_Common_Strings_01 Create hunting rule
Author:	schmidtsz
Description:	Identify partial Agent Tesla strings

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

exe def920207a8b0b441f3744dac84c6f67c8f1ba6d84d31a3beeda75ccdf510d85

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2710131/

URLhaus

https://urlhaus.abuse.ch/url/2712413/

Cape

https://www.capesandbox.com/analysis/449552/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-09-19 05:18:46 UTC

url : hxxp://185.28.39.18:7777/185.28.39.18/arinzezx.exe