MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0b9c05954186f5d54bcaf95e425448540d4a0fdc6cac1a12899bda66e38ac37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 18


Intelligence 18 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0b9c05954186f5d54bcaf95e425448540d4a0fdc6cac1a12899bda66e38ac37
SHA3-384 hash: 50c4fc13cc61417d293c218e18d29aa8eddf1ce51fea2c887e2904fd02854a37d9d6deec58073cf8cd8958bbb5561e9a
SHA1 hash: 0730ad97d7027f78ba21464f4b1dabb49b44a904
MD5 hash: b52da573d67f518074e7240c677f5538
humanhash: sad-spring-orange-island
File name:rShippingDocuments.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:684'544 bytes
First seen:2024-08-21 11:55:59 UTC
Last seen:2024-08-21 12:04:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:F9i5CwgqaVouizROQjjfIjfw2nPr7h5knVdw0pDNVLcoBzsn5Klx:F96C/qaSuizRhjjfUfw2nPr7hSVdwmJN
Threatray 1'172 similar samples on MalwareBazaar
TLSH T1C9E4128076B85B13E06A8BF50690E6706BF96E72B112F7485DC77CDB763BF001282697
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter FXOLabs
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
378
Origin country :
BR BR
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
rShippingDocuments.exe
Verdict:
Malicious activity
Analysis date:
2024-08-21 11:58:44 UTC
Tags:
netreactor smtp exfiltration stealer agenttesla
Link:
https://app.any.run/tasks/3457b403-f198-46fa-830e-4994b7a9d6ca

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Packed.Malwarex-10034927-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66c5d5d6e7ff3f5a063bb2c6
Tags:
Discovery Execution Generic Infostealer Network Static Stealth Msil
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade packed vbnet
Link:
https://www.filescan.io/uploads/66c5d5dba47cf488f15abb4d/reports/a67cf3f9-2ac6-4278-8c50-b66c8cec2784/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/e0b9c05954186f5d54bcaf95e425448540d4a0fdc6cac1a12899bda66e38ac37
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9d1d7830-86a2-4f58-8950-e457379ba0f9
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1496565
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1496565 Sample: rShippingDocuments.exe Startdate: 21/08/2024 Architecture: WINDOWS Score: 100 65 mail.starmech.net 2->65 67 api.ipify.org 2->67 73 Found malware configuration 2->73 75 Malicious sample detected (through community Yara rule) 2->75 77 Sigma detected: Scheduled temp file as task from temp location 2->77 79 10 other signatures 2->79 8 rShippingDocuments.exe 7 2->8         started        12 jgTsuVqJQ.exe 2->12         started        14 BjTxJte.exe 2->14         started        16 BjTxJte.exe 2->16         started        signatures3 process4 file5 57 C:\Users\user\AppData\Roaming\jgTsuVqJQ.exe, PE32 8->57 dropped 59 C:\Users\...\jgTsuVqJQ.exe:Zone.Identifier, ASCII 8->59 dropped 61 C:\Users\user\AppData\Local\...\tmp6E1D.tmp, XML 8->61 dropped 63 C:\Users\user\...\rShippingDocuments.exe.log, ASCII 8->63 dropped 95 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->95 97 Uses schtasks.exe or at.exe to add and modify task schedules 8->97 99 Adds a directory exclusion to Windows Defender 8->99 18 rShippingDocuments.exe 16 5 8->18         started        23 powershell.exe 23 8->23         started        37 2 other processes 8->37 101 Multi AV Scanner detection for dropped file 12->101 103 Machine Learning detection for dropped file 12->103 105 Injects a PE file into a foreign processes 12->105 25 jgTsuVqJQ.exe 12->25         started        27 schtasks.exe 12->27         started        29 BjTxJte.exe 14->29         started        31 schtasks.exe 14->31         started        33 BjTxJte.exe 16->33         started        35 schtasks.exe 16->35         started        signatures6 process7 dnsIp8 69 mail.starmech.net 207.174.215.249, 49716, 49719, 49722 PUBLIC-DOMAIN-REGISTRYUS United States 18->69 71 api.ipify.org 172.67.74.152, 443, 49713, 49718 CLOUDFLARENETUS United States 18->71 53 C:\Users\user\AppData\Roaming\...\BjTxJte.exe, PE32 18->53 dropped 55 C:\Users\user\...\BjTxJte.exe:Zone.Identifier, ASCII 18->55 dropped 81 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->81 83 Tries to steal Mail credentials (via file / registry access) 18->83 85 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->85 87 Loading BitLocker PowerShell Module 23->87 39 conhost.exe 23->39         started        41 WmiPrvSE.exe 23->41         started        43 conhost.exe 27->43         started        45 conhost.exe 31->45         started        89 Tries to harvest and steal ftp login credentials 33->89 91 Tries to harvest and steal browser information (history, passwords, etc) 33->91 93 Installs a global keyboard hook 33->93 47 conhost.exe 35->47         started        49 conhost.exe 37->49         started        51 conhost.exe 37->51         started        file9 signatures10 process11
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e0b9c05954186f5d54bcaf95e425448540d4a0fdc6cac1a12899bda66e38ac37
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e0b9c05954186f5d54bcaf95e425448540d4a0fdc6cac1a12899bda66e38ac37/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2024-08-20 08:45:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
26 of 38 (68.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4c44awkudbxv2vf4v6k6ijkeqvanjih5y3fmdijitg62m3ryvq3q._file
Verdict:
malicious
Label(s):
agenttesla_v4
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
053c940f835b1c6624b6b0421b680da5c984b056734db107a7d6c8dfbe1837fd
AgentTesla
35a9609805bde63b4e22255d365fc6a61724fcb9f8456899bb085b76f0160d5d
AgentTesla
576f4658c5c58273967350871dfd6d60e64d54d772c812f8507de67d4784f6ff
AgentTesla
8e3db35284b6e1ea560c14a69ea4dfd6ef8e27fe9974a609116d00f2d764bfeb
AgentTesla
a76d6e19ac59db6afea91b625c29f06f25316ccb74e1b7bdd59c68cb0aefac34
AgentTesla
e0b9c05954186f5d54bcaf95e425448540d4a0fdc6cac1a12899bda66e38ac37
AgentTesla
+ 1'162 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla credential_access discovery execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/240821-n31vla1akr/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Credentials from Password Stores: Credentials from Web Browsers
AgentTesla
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/439b39d1-ba57-414d-afac-cdffca24524b
Unpacked files
SH256 hash:
06be72c8b0a98aced062677e89bf7b099b9d54f77cb13ada35406b78dff33128
MD5 hash:
81a6ede37cca132b375d4e89dc3e0235
SHA1 hash:
eb8747a243a6e5b6261d45f88aec794661b09aff
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/c952a923-6ae0-4622-9253-0dc2b5381af4/
SH256 hash:
8ded42c9497f99dd8b747b8da9c7963e6fa3d6e7f3622ef1fbaa04b50efe9d17
MD5 hash:
7017a883e86a0e5bdc2ab2d18534cdf9
SHA1 hash:
b40fc9e21fa53ddc9b4ff6cafc7d0b591bfc34a8
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/c952a923-6ae0-4622-9253-0dc2b5381af4/
Parent samples :
8f81ed1c250530c6a24f60a8f0c39f48bd2c98f08e6100bc8f844fc3a53c6909
7534c32fa2dff5d752801f84545c23d8c09b7b8a698a61169a9e1a851699120c
7e9e2285a304449495c336285f1f7f0153c175ab2cd5c35492d6565d89c8c137
6cc066c3a33644d8a54496de97374b7a8804b490f7d3ca66c62c1bc6cb695fa5
72e7a39bce46e45402cbb4ae13053d57e87a62b06b53164acbe8c18ccf7dc696
db87b7e683d92aa8d013663c6bc6ba116023af2cb7f9ec6c2ad88694235f2b12
d6cbd0b24b82cebe1a66094b0678d66c5f508f5a1c98d7143de9d1871daeffc3
72e3890b8af3c836705f640704aa03680b1092e5c021a2bfff35d931062bfd89
13f0a05e86fdf85e8891b494574421ff3da0be5e7a71e48f7e32f6c9f35eb2f7
7d50338fe1feeb6944bfd552e44f266d764dafc089b853a6ee24f67ef322c124
9e6875db397f7d76fcae09d39360a73237b11b1fbfcfa7275bb7fe7cf0d87df8
943d44f043396e794716c4d82c4345e749eead0807592339cdde186a7bd83c51
a76d6e19ac59db6afea91b625c29f06f25316ccb74e1b7bdd59c68cb0aefac34
b9996528bea4f182b005ba60e72f604602f0749e5b083a013d6096a3960052d2
00082a148e8eb6745164c0cbf7c142539ada8fb4004deb8b3ae028b7181c552b
053c940f835b1c6624b6b0421b680da5c984b056734db107a7d6c8dfbe1837fd
8e3db35284b6e1ea560c14a69ea4dfd6ef8e27fe9974a609116d00f2d764bfeb
e7573cb6869df680fa42552e27b1a6bd2cd5a76c48b1660a41897dc30a0e53ba
f8353eb981e7fce8af5663a30b6ad844d44d7eda87ff717f85f0046e3c065985
ee6a1171d804498d93b3877e1649a3f0075ffad676875c875e4778823323692e
35a9609805bde63b4e22255d365fc6a61724fcb9f8456899bb085b76f0160d5d
d00af7d1aa35864537045299a782f3b010d5fe3a7e40bbe04846a2baa07a93a3
75a2f037e46961ac9e70ac8a8d52f06b4b20786ac7ac596abbb039c6a2715430
d3c4f42060fe5520553f915832b413f6f8f0f55307646f86b44b150389069463
40cebb630f935210e93b1e5569a1181a0c19cee3c4c129550dece7add29f27b6
f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d
013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5
8b9ed7cbe84b68a9b190a2cfc34c605bc1e2f3851f8eeeb84d4313d8b42431ff
c9f0c595e62ee31b17e1b62cc7be551a1cd46c3395a282fead293a5033674328
046735ced511c1064c2ea51fe6fd55ea1dc5a2d19e608bea4c8df9f8f376a78d
29fc4ec2272e265faf58a71365d463e953c20dcfa192b6208a1fd6ddd25a7f11
4da4d8e83255158a09663b9da8faaecae3a0a9175571aee37567f224cb34e694
d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277
81ed143389ad903c7669aa1da459fbda5b0d93a157ddddb7ddc1ff8e22b97e96
e762546dc786deba408a71f5cb8369a84e56e07c21e75ac56a4a7dad522b28af
878f318722d59f4bf5e617bf4daef2f12f539170f16d5b263d816a03b9d5107c
1ee774ec1cf70a9cbb1a383d7c7c61156308d936e070a0b8e726b9892dde2ca9
ae284655948354c6ed48e95cf2aaa058d376ed19d2aa69aa38eecea72ee2f576
6fce035d54888d7895091ecee886b64043cbcb5cdb410457411ae156a822973c
576f4658c5c58273967350871dfd6d60e64d54d772c812f8507de67d4784f6ff
03bc82a58bda7eff17320728048c0d37fa376a64f08504e7c0454b743790d5ac
1fb620b3a5fef04e16e34e800f05b3cb7cbad920b33c66d799d305ad15801224
dcb417103bd0f315ba7cd30f1eadfca56a56122caec7ce4afe96b410931f43e6
7bc7edf2f2fafaa8457fb596cbbcdedafd23544d75e739e777b73790965df6bb
584022a11fa25bc77ada9ec361c791001f8d8da848930b386f42841d9e0be7d6
93af04866fe94141664174864c6965777d7f78897a27ca858d6f79b653ca943a
23b9b4a46c15c5fa3b7445e8041852f3dc831547903250209ca738b1a17fb7c2
ae082792bb09ee973564e6e71c92f547fcbef3fd5d6c3b4f8e2172044cf2591e
496ba3f23ddaf5c1514228f1ca90b1de4392a159eaac3ecbd5fbe3fbb28f819f
bd0e1cfd8ac5fef73e78b0a784c11682ed8d3120e6293d7d87425e5cd65d91eb
e0b9c05954186f5d54bcaf95e425448540d4a0fdc6cac1a12899bda66e38ac37
3a4cfc46e94f08076d2ada85e0d51cf06695bfb54ad5f37c316c70d582839d15
94338a235c9207ba31032496ba04d39ae887a3155c15d57347307df2dfa16242
7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a
d613473068f000318d1015b85a0f49f9191263041ae8debcc7250876ae146304
4813a5905b2003965fe10155c8daf3cdbb57017af02483a53a2d5ca11a9270f7
cda34c7ddc45a0ac67f0f3745b91686c285bc86f108c5c2deb36c1c3a0fb5a4f
0876a062221ba67194143bb2b1fc83d87b22860cf5e8cff64239b4b9dc251d11
7fb1caac122f0f3640e234a54256f2a97b44bdd0881124191c352c7e797b7dc2
SH256 hash:
6acc5d6df27e7a7c84a02305b36188873a3fc0c9cefcbecb82af0c6a1609047c
MD5 hash:
20d04d15be1f8344803d537c208844a4
SHA1 hash:
965b5b2bad3428cb11b1988247b6c593d64e6a3e
Link:
https://www.unpac.me/results/c952a923-6ae0-4622-9253-0dc2b5381af4/
SH256 hash:
ab737fa94d5638dc23955700ae5443fa7a05882c821c51b995935a91e42c3561
MD5 hash:
8ae00a26ba2f9f1d519fd6455db2cb4d
SHA1 hash:
9270d95cc7f7a8d1915de694d54a550b3c683684
Detections:
AgentTesla
Create hunting rule
win_agent_tesla_g2
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/c952a923-6ae0-4622-9253-0dc2b5381af4/
Parent samples :
6c06c665c435cf95787310f59e984006711d50bf091ae610cb4440abae1448c4
e62255f98543e0bb1abf017af13fd483e1382158021b7edde65fa55c1ad290cf
433327373b99264a0a5f11194a3722e1a53c832e837f0eab264f89306f9e42cb
3029eb76575a110e9bfeadcee488cb4db00d25da6d8529e48d49f2fee0770f80
98b85ee0663117740bdac3c6af9fd2c637206f83be0978b865bc9cce1cc2eb51
6a73ce1fbde07e660aa6713b7e1c20cc34aa6f576d82f2189da9661abaa5211f
9b2a20382a2f0aa6745217b19f51ba20f0e9bf07121ae3ff6aa0ec74850b0507
ca4db0fd02f9a6e22c53d273087156269b720cf0b92140c67cc0cbc9d279cc26
ecbd820686317cc38e97ceac59f26f853bd924695b2d124c4e87f5f48c82bd63
21e7743ee49b00d201af99fbd9fc0a430032f416070834294b12f3ea2c12b48d
ab0d0bb327fcb4f057c64df4d03ac22f606461f5ab86cf0543ace64c30110c35
36136923c9475c273bce4a1c5bff84b565635565a6bf470e6626ea33a4c3a358
ad9b8625f2d2b98ff577f78aaf80cd4ab30b640680135cbb2328a3ffbb1623bb
bd0e1cfd8ac5fef73e78b0a784c11682ed8d3120e6293d7d87425e5cd65d91eb
e0b9c05954186f5d54bcaf95e425448540d4a0fdc6cac1a12899bda66e38ac37
5f9a7f6a183b3966e84173f3ea7fec1ed563e9cd08577d87d523d9f69f66eb8d
0222c1554ceb01925bccffabe846186b951f8b48a9f1731ed25d51c42761826e
1ddb5066864496c4fdb477252d09eee2f3304d5801c93bc9a72acb22eb78523b
cb8e8d185adfffe272bafb00ef1000724beac1e478fba3e50682ac0c2300d0bc
4c2de5043cb67a6805824b096a6640ab47b60c0c1ed71a452d3228144c92b0f3
0989a20ad0aceb20e2199f0bceaec9461f94b49899f7d2cb1ce61d05473f5d1a
cb9790cad0a60c5d06786c99700a84a880c04abf6477ab97453b13ba386306f4
097c7472803e5dca675ac074c1092848ae92cb468447eb8d0b57afe392c156ad
0d7a4a69f12914329cbff3ca263858dac70c0b5afa1657806129e553fd9e246e
8a8794d42a442da3a12f8424a51685fc7da1b9113452b2a5dd1ef23352b5f0b6
4814d2923369ffb5245d01dc4d9854aadd669fed95cfe32c24919256b2176165
4bf19e00f15d689c108b9935716d0f5f34be07e6a08c39dd715bfbe806d99fe9
f303f80350d34a05961ace4456cc3408510a36852b94a75e0e9abfcd75f803b6
4bffa4186f899e3474a07b07fa5caaec795250cfe89d4c24b9369e2da967238f
7abd614a718eae6e0544e6828c834f275248093b5d807b7cc5c4de975dc7abc9
24ce2be70ffbceba0067972a154cba571866cbeca67e2132bc01352f46acd9b6
42c52ed2af4708289cb182a0fd83026691eabc7c4916a3ef0cf8a01b5f890856
e16ed69e1d337d88539ff98cda8d36aabc495db375d68e4f9b86a1843ad8c679
887f393b62c6c4b69e81cfc772397619082d936dd38cbcbc0f54b623ef871af6
487a65a744364c95696bf450fe78819afac41980fb6a106231f84aa0835aa5f2
496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2
b8dbf3db5d56d847b13c3e517dd9e9e396038948ea1189e7f57c419f493c368c
a689d2c7fa2cc3712ff115a0dce0cd90c5d55c92bc87e7f24dcd05ad4a38db63
4bb53e8f6293f4328bc49ed18f542bb729d48f6841c171438e1bd42b02ed23b7
83a7159eda11a47065c266929a9ea0c387be8db616b2d46c75a18c4e473760c8
72c54730956921bbe2e5d9013b3dfdc738a98a2868ace2b85d7becc16ae6e55a
6a48b22bd969313fc663ff3517d4d95c316623f099b68a0b5499cb0bb7f68f0b
SH256 hash:
e0b9c05954186f5d54bcaf95e425448540d4a0fdc6cac1a12899bda66e38ac37
MD5 hash:
b52da573d67f518074e7240c677f5538
SHA1 hash:
0730ad97d7027f78ba21464f4b1dabb49b44a904
Link:
https://www.unpac.me/results/c952a923-6ae0-4622-9253-0dc2b5381af4/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e0b9c0595418/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e0b9c05954186f5d54bcaf95e425448540d4a0fdc6cac1a12899bda66e38ac37

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe e0b9c05954186f5d54bcaf95e425448540d4a0fdc6cac1a12899bda66e38ac37

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments