MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6d98d839dd2372b008ed4ec970c951963b863f89959d2d917cbe32fe7ce7f21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6d98d839dd2372b008ed4ec970c951963b863f89959d2d917cbe32fe7ce7f21
SHA3-384 hash: 8712d4a81bccb522447ec85539824863866b463f4bf593b8ee7525a2cd71d8d2fbb9cb3351f7b8af305950cbd48a1c06
SHA1 hash: 1c61bbb9f59be189824cab14abdd2c738a0e8254
MD5 hash: b50d51566d5c2c7bcc0c23b1d81de620
humanhash: illinois-october-minnesota-island
File name:e6d98d839dd2372b008ed4ec970c951963b863f89959d2d917cbe32fe7ce7f21
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'688'261 bytes
First seen:2023-05-09 12:28:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 12e12319f1029ec4f8fcbed7e82df162 (388 x DCRat, 52 x RedLineStealer, 51 x Formbook)
ssdeep 24576:lTbBv5rUfDXLVSwpZsB6/EAunyTozjvKOidwt2M4KXGCpmTuqaS5kldxdSRgb:PBMXBCk8AdTojvMwtzKCA7aP3R
Threatray 533 similar samples on MalwareBazaar
TLSH T164751202BDC294B2D4621D3286766B22AA3DBD702FB58EDF53C0766DCA305C1D73176A
TrID 89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.5% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 31f0c0b2b2c0f031 (2 x Formbook, 1 x QuasarRAT, 1 x AgentTesla)
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
257
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e6d98d839dd2372b008ed4ec970c951963b863f89959d2d917cbe32fe7ce7f21
Verdict:
Malicious activity
Analysis date:
2023-05-09 12:27:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6299a251-e970-4f03-90b8-906e951ea11a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/387829/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.38920448.13962.7593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Launching a process
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Reading critical registry keys
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/83199/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
91%
Tags:
anti-vm autoit greyware hacktool keylogger overlay packed packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/645a3c8f3b40ceeb9637be89/reports/718259b4-efb8-4699-a3e3-a4cdb0ef7db2/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/e6d98d839dd2372b008ed4ec970c951963b863f89959d2d917cbe32fe7ce7f21
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/58a52f10-54db-4618-b5cc-c39f1a0eb6b1
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1229169
Signature
Antivirus detection for dropped file
Drops PE files with a suspicious file extension
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Starts an encoded Visual Basic Script (VBE)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM autoit script
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 862150 Sample: dzgUgZt2Gt.exe Startdate: 09/05/2023 Architecture: WINDOWS Score: 100 96 Antivirus detection for dropped file 2->96 98 Multi AV Scanner detection for dropped file 2->98 100 Multi AV Scanner detection for submitted file 2->100 102 6 other signatures 2->102 14 dzgUgZt2Gt.exe 36 2->14         started        18 tjubum.pif 2->18         started        20 tjubum.pif 2->20         started        22 tjubum.pif 2->22         started        process3 file4 86 C:\vwvf\tjubum.pif, PE32 14->86 dropped 88 C:\vwvf\amorim 4.0.exe, PE32 14->88 dropped 112 Drops PE files with a suspicious file extension 14->112 114 Starts an encoded Visual Basic Script (VBE) 14->114 24 amorim 4.0.exe 2 14->24         started        28 wscript.exe 1 14->28         started        30 wscript.exe 18->30         started        32 wscript.exe 20->32         started        34 wscript.exe 22->34         started        signatures5 process6 dnsIp7 90 oscarrojo.com 185.37.231.211, 49695, 587 SOLTIAES Spain 24->90 92 mail.oscarrojo.com 24->92 106 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 24->106 108 Tries to steal Mail credentials (via file / registry access) 24->108 110 Tries to harvest and steal browser information (history, passwords, etc) 24->110 36 tjubum.pif 4 4 28->36         started        39 tjubum.pif 30->39         started        41 tjubum.pif 32->41         started        43 tjubum.pif 34->43         started        signatures8 process9 signatures10 104 Multi AV Scanner detection for dropped file 36->104 45 wscript.exe 1 36->45         started        47 wscript.exe 39->47         started        49 wscript.exe 41->49         started        51 wscript.exe 43->51         started        process11 process12 53 tjubum.pif 1 45->53         started        55 tjubum.pif 47->55         started        57 tjubum.pif 49->57         started        59 tjubum.pif 51->59         started        process13 61 wscript.exe 53->61         started        63 wscript.exe 55->63         started        65 wscript.exe 57->65         started        67 wscript.exe 59->67         started        process14 69 tjubum.pif 61->69         started        71 tjubum.pif 63->71         started        73 tjubum.pif 65->73         started        process15 75 wscript.exe 69->75         started        78 wscript.exe 71->78         started        dnsIp16 94 192.168.2.1 unknown unknown 75->94 80 tjubum.pif 75->80         started        82 tjubum.pif 78->82         started        process17 process18 84 wscript.exe 80->84         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e6d98d839dd2372b008ed4ec970c951963b863f89959d2d917cbe32fe7ce7f21/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-04-27 15:55:01 UTC
File Type:
PE (Exe)
Extracted files:
509
AV detection:
24 of 37 (64.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=43my3a452i3swaeo2twjodevdfr3qy7ytfm5fwixzprs7z6op4qq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
37203c38c11b529b8d10382dfb610e739ceb38daae8bc1c19f28506edf3dfdd1
AgentTesla
51ba2b6912305fd63c041dccff36db067314cab3f93227aaf21990801efa0b25
AgentTesla
592217d2590ae9ca688346688b2d7d13a78190f9562889597ebb79060136034c
AgentTesla
64359ddf637e15b2f3f8e0360d23caf8d2d5d51680b8709bde3eaa392978043a
AgentTesla
726bc1cc141d4ad30a0a1622d3aa8ac21af76273180b0efd160d2cc12d4a7fcb
AgentTesla
8e16304b756988b8fedf67c9c0eee38873fa743a2e9beae9bfc7bc44206e6a5d
AgentTesla
ced55c9b4b3dba810dc674575818bb4d9dc828d3df6efee4a15d85ac24abd69b
AgentTesla
d12374b77206c950e02f93c953e663d3f09a9708f9313ae0a74c636cae4851b8
AgentTesla
fe8269a96b39d622796d4ded1ba8c9bed83e8abb17d0c159f8a3eac96594c965
AgentTesla
+ 523 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230509-pnwsrshg21/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
018f8ecb24d522f66ad485b52509e8697cea83eac96a7d3e22f82d2699cc91bb
MD5 hash:
9b964286ef906fdf2f2152602492603a
SHA1 hash:
ccecbb255468387a4f68c515d241c45aa5a422ff
Link:
https://www.unpac.me/results/b9164133-1efc-4140-b08f-a5e84b3ccf2d/
SH256 hash:
b1ac0e8a278c614f9bb24ad9f80ea3300e3073d7100ad88acf836e956a3c6655
MD5 hash:
915a718145f1bd48884953e1fc1f06d6
SHA1 hash:
c2f9992fad8d7696524f20f60c36865091f9029f
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/b9164133-1efc-4140-b08f-a5e84b3ccf2d/
SH256 hash:
e6d98d839dd2372b008ed4ec970c951963b863f89959d2d917cbe32fe7ce7f21
MD5 hash:
b50d51566d5c2c7bcc0c23b1d81de620
SHA1 hash:
1c61bbb9f59be189824cab14abdd2c738a0e8254
Link:
https://www.unpac.me/results/b9164133-1efc-4140-b08f-a5e84b3ccf2d/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e6d98d839dd2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e6d98d839dd2372b008ed4ec970c951963b863f89959d2d917cbe32fe7ce7f21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/387829/

Comments