MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e215e9e90f3aa064ca0df91993ab91f086fe918e72c05de21307b75b1cd164ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e215e9e90f3aa064ca0df91993ab91f086fe918e72c05de21307b75b1cd164ec
SHA3-384 hash: 0d775ce819d432b7176e56ec4d3d1c76b1dd27c62f0642b20b7fc07e0c7978a42c3cf7f5828f4241cf0abf4293971316
SHA1 hash: 38b9845b5c9a87ee8bac6e2edaba949270f32d59
MD5 hash: 73621af47a6b6943527d85fda07b3bc6
humanhash: apart-low-jig-rugby
File name:SecuriteInfo.com.Win32.TrojanX-gen.5490.3978
Download: download sample
Signature AgentTesla
Create hunting rule
File size:891'904 bytes
First seen:2023-09-18 19:35:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:H8hkSMdr3GNUAn9cNNeX8X/iTS46omhsIStxFmcPU/uCjV/08Jmb3zZX1BED3jro:H8PIaxscPsWeqK8fafPO
Threatray 5'712 similar samples on MalwareBazaar
TLSH T1E315F87530FA2512C733E7E20BD9ACAE9799F237121EF67B348113974652E019AC2736
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
279
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.TrojanX-gen.5490.3978
Verdict:
Malicious activity
Analysis date:
2023-09-18 19:39:19 UTC
Tags:
stealer agenttesla
Link:
https://app.any.run/tasks/57111347-eba1-4bbe-9aeb-dd3212c9958d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/449450/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.5490.3978.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/6508a6a333582f234efb25ab/reports/92266323-cb75-4d95-95f3-099b8e59230d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/e215e9e90f3aa064ca0df91993ab91f086fe918e72c05de21307b75b1cd164ec
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0674088b-4b6f-4310-a96e-71a88fc8542a
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1310324
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1310324 Sample: SecuriteInfo.com.Win32.Troj... Startdate: 18/09/2023 Architecture: WINDOWS Score: 100 30 Found malware configuration 2->30 32 Multi AV Scanner detection for submitted file 2->32 34 Yara detected AgentTesla 2->34 36 4 other signatures 2->36 6 SecuriteInfo.com.Win32.TrojanX-gen.5490.3978.exe 3 2->6         started        9 operas.exe 3 2->9         started        11 operas.exe 2 2->11         started        process3 signatures4 38 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->38 13 SecuriteInfo.com.Win32.TrojanX-gen.5490.3978.exe 2 5 6->13         started        18 SecuriteInfo.com.Win32.TrojanX-gen.5490.3978.exe 6->18         started        40 Multi AV Scanner detection for dropped file 9->40 42 Injects a PE file into a foreign processes 9->42 20 operas.exe 2 9->20         started        22 operas.exe 11->22         started        process5 dnsIp6 28 ns0.ovh.net 193.70.18.144, 49714, 49717, 49720 OVHFR France 13->28 24 C:\Users\user\AppData\Roaming\...\operas.exe, PE32 13->24 dropped 26 C:\Users\user\...\operas.exe:Zone.Identifier, ASCII 13->26 dropped 44 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->44 46 Tries to steal Mail credentials (via file / registry access) 13->46 48 Hides that the sample has been downloaded from the Internet (zone.identifier) 13->48 50 Tries to harvest and steal browser information (history, passwords, etc) 22->50 file7 signatures8
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e215e9e90f3aa064ca0df91993ab91f086fe918e72c05de21307b75b1cd164ec/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-09-18 19:36:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4ik6t2iphkqgjsqn7emzhk4r6cdp5emoolaf3yqta63vwhgrmtwa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
04da2f944fcdb4f4121e4c091600b838be5de5e40acbd87c82f773126ac604d5
AgentTesla
099239f804cec77a75d9142dbc302c3c75fb607ec967d9ee38ea1eb21b392a49
AgentTesla
2c5dd99359922ca8602912abb64dca0d5eadaaf4bb8d16e70d9d50515c607fe7
AgentTesla
56db39cdbbc1114a3eba86d4be46a5acd5d9457c5fca845ee439a3f73fc16ad0
AgentTesla
6eddba1588ba6d7183a7940a9974cc188c5473a5087f6853dc40c48df726d598
AgentTesla
82ae8b641802c420ff135b3fd35200efe056925be8e025497805f1f2aa6673e1
AgentTesla
bbff2bce7c553d1e11b48a38bfd351f9e715b683171f596751d78ace10782e79
AgentTesla
de712fa4071f54a816f2908cea5ea4e23d2ee37edb32c91464d4d8eccb773b97
AgentTesla
ed3982e7290f9d8480fdc01e4828f4fe317c9a875180fe72903aa28906479e4a
AgentTesla
+ 5'702 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230918-ya8d3sef59/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
4a8d70ece798fb6955e46bdb4b4813924a3bbcf205e585fd0aef148123a44489
MD5 hash:
3bcd5e9d69da03ebe27b9c2e472d9e8d
SHA1 hash:
aa268bd00ed60a5907b4b2a669ddd21a1b8bb4da
Link:
https://www.unpac.me/results/482b8879-79f5-493e-a6a9-cff3c19e0bdb/
SH256 hash:
06e2bf776c7c127af067083fa2d8133c806f13eb32c51313b97e4ca82a591cb4
MD5 hash:
723dcef9911f569e042aa0aa1797b7e0
SHA1 hash:
947f00c723f8d69cfe8b81a76563489f6ffcc7f0
Detections:
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/482b8879-79f5-493e-a6a9-cff3c19e0bdb/
Parent samples :
099239f804cec77a75d9142dbc302c3c75fb607ec967d9ee38ea1eb21b392a49
e215e9e90f3aa064ca0df91993ab91f086fe918e72c05de21307b75b1cd164ec
SH256 hash:
0630b864e828fff2d66f33ab7d00fad231df4c00fc0bbad313ee0d12ca503198
MD5 hash:
f559a9abbd849eb977d262d597d6e4fd
SHA1 hash:
0a8769b40b026852690c89b913c2812817ef43c8
Link:
https://www.unpac.me/results/482b8879-79f5-493e-a6a9-cff3c19e0bdb/
Parent samples :
cef72412a1dd9486bae5f7e606d4330660fba98575ba1c939559ccc83536f41a
81ccf158093718305b3499d0f16d8a82bcad69f2740066daca8d5b5ca9979688
SH256 hash:
ebbab284f562d558d6a3800d9f46ad67e7a45d1b111833eee69b0bae5ebd8b22
MD5 hash:
6ed160e971f25d45c138292dccb22265
SHA1 hash:
03d6b83d2b6aae53d1521dad5f7b1a92117fbaef
Link:
https://www.unpac.me/results/482b8879-79f5-493e-a6a9-cff3c19e0bdb/
SH256 hash:
e215e9e90f3aa064ca0df91993ab91f086fe918e72c05de21307b75b1cd164ec
MD5 hash:
73621af47a6b6943527d85fda07b3bc6
SHA1 hash:
38b9845b5c9a87ee8bac6e2edaba949270f32d59
Link:
https://www.unpac.me/results/482b8879-79f5-493e-a6a9-cff3c19e0bdb/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e215e9e90f3a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e215e9e90f3aa064ca0df91993ab91f086fe918e72c05de21307b75b1cd164ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe e215e9e90f3aa064ca0df91993ab91f086fe918e72c05de21307b75b1cd164ec

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2712291/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/449450/

Comments