MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e759e4e0ba6d3e577ba3dc31a6ff4af77779a92afef0a7dd1814d23b7fe3ed03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e759e4e0ba6d3e577ba3dc31a6ff4af77779a92afef0a7dd1814d23b7fe3ed03
SHA3-384 hash: 9ec43f7ad84a1fa78e47e258819c67b83255780ab53f60df4ecfdc8aa98c5edebc83432fb8958545d4f5fe186f8108fe
SHA1 hash: 90d71c10593ee4b7a53c8ee0e412ceb606564c91
MD5 hash: cfadfb5515950bb1142145daee782701
humanhash: alpha-speaker-wolfram-nebraska
File name:Due invoice.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:604'672 bytes
First seen:2023-07-07 15:16:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:Agjjk9TCxo/5VimB/iyb5yXRbT2ToYNWYX0XtkB+5tXO7ZAJoY:Agjjk9TFVibyb52R8oYNWYEk05Y9AJoY
Threatray 364 similar samples on MalwareBazaar
TLSH T1E8D40233EE2487ABE4855FB8140157802759F742813C9E2835FBF1CA58B9BF170AAD97
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
297
Origin country :
US US
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
Due invoice.exe
Verdict:
Malicious activity
Analysis date:
2023-07-07 15:17:24 UTC
Tags:
agenttesla
Link:
https://app.any.run/tasks/3cdc6526-c16f-4787-846d-7447a8230aed

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/410897/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.20708.3946.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Creating a process with a hidden window
Launching a process
Restart of the analyzed sample
Adding an exclusion to Microsoft Defender
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/64a82c332333b198b2391f4d/reports/b81809ec-a298-4d62-bd6b-b8acb921684b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/e759e4e0ba6d3e577ba3dc31a6ff4af77779a92afef0a7dd1814d23b7fe3ed03
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a464b964-d9c0-4f47-961d-157e27c145c6
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e759e4e0ba6d3e577ba3dc31a6ff4af77779a92afef0a7dd1814d23b7fe3ed03/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-07-07 15:03:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
18 of 24 (75.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=45m6jyf2nu7fo65d3qy2n72k653xtkjk73ykpxiyctjdw77d5ubq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
8b2a9586bcf26045ba196d4714d8c628feb5d8eed4604ff82c6e3625b67a9437
AgentTesla
93b7218292f0aeb19a02ac6ef036903df02c10f99b39132c12505e6fec6c68ae
AgentTesla
940452c26b4fd683f1c88746b751d4299e9b8c3fe25aa62168eca31924c17592
AgentTesla
a8d70bf9cc12fbfb715e24cd0591c6e42d4f7e11b67b004255d16bbb26e0b43a
AgentTesla
ccc2705cc016a910af89b39b5beeca2885eedd714cca5ab153b416c201d0ea96
AgentTesla
d6f97400d822eaccbf90e7a0dc62b32e8073ad22185c28c065eca47bda82e044
AgentTesla
e57c444a50a0cb9ac14152220923763532f8a280c37ff45ee55ef28844740434
AgentTesla
f47b5a1548d7d1ecf22e19ea995bb81111132ab5543037903f59acc83316fa1c
AgentTesla
+ 354 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230707-snfy4ahh87/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
371177727d5c64ad0a976db10d172d32e5a2c7621299186d85dea7101d201724
MD5 hash:
0fdadcad944366c3629c5f4a92d170d0
SHA1 hash:
9d3d5af3c7228d3f5772ce0f87915be4b86d74ca
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
SH256 hash:
593e0e9b77b0fe843cb1dd0f879b7928280f917da00e4415a75f835bdf04e8d2
MD5 hash:
f90558c653e974448c269c08bc56fdd0
SHA1 hash:
95b8b04451ecd2e558e93e3f85dbc542794e2a84
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
SH256 hash:
05aec629dc27cf686a10ff2dafa1dd8969ccc25c27a3fabe6d7ead88c05e5dfc
MD5 hash:
2e44bcd76808919ddaff1043f3ca0574
SHA1 hash:
188c19f44f150bdc5c723cd7a2e337de60c58c3b
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
Parent samples :
f47b5a1548d7d1ecf22e19ea995bb81111132ab5543037903f59acc83316fa1c
e759e4e0ba6d3e577ba3dc31a6ff4af77779a92afef0a7dd1814d23b7fe3ed03
db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb
60755b9a1273f9dc3834df3111a64542a47ea1cb334aa95ae4515476a8b048da
89838c428e6292848d7e8345eee67d50c664b078751c74d7f3db20ebca31c675
069c1a556943461282bfbf8411afc6213a359df9ce4894a80881e45a2ba9bc84
SH256 hash:
371177727d5c64ad0a976db10d172d32e5a2c7621299186d85dea7101d201724
MD5 hash:
0fdadcad944366c3629c5f4a92d170d0
SHA1 hash:
9d3d5af3c7228d3f5772ce0f87915be4b86d74ca
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
SH256 hash:
593e0e9b77b0fe843cb1dd0f879b7928280f917da00e4415a75f835bdf04e8d2
MD5 hash:
f90558c653e974448c269c08bc56fdd0
SHA1 hash:
95b8b04451ecd2e558e93e3f85dbc542794e2a84
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
SH256 hash:
05aec629dc27cf686a10ff2dafa1dd8969ccc25c27a3fabe6d7ead88c05e5dfc
MD5 hash:
2e44bcd76808919ddaff1043f3ca0574
SHA1 hash:
188c19f44f150bdc5c723cd7a2e337de60c58c3b
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
Parent samples :
f47b5a1548d7d1ecf22e19ea995bb81111132ab5543037903f59acc83316fa1c
e759e4e0ba6d3e577ba3dc31a6ff4af77779a92afef0a7dd1814d23b7fe3ed03
db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb
60755b9a1273f9dc3834df3111a64542a47ea1cb334aa95ae4515476a8b048da
89838c428e6292848d7e8345eee67d50c664b078751c74d7f3db20ebca31c675
069c1a556943461282bfbf8411afc6213a359df9ce4894a80881e45a2ba9bc84
SH256 hash:
371177727d5c64ad0a976db10d172d32e5a2c7621299186d85dea7101d201724
MD5 hash:
0fdadcad944366c3629c5f4a92d170d0
SHA1 hash:
9d3d5af3c7228d3f5772ce0f87915be4b86d74ca
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
SH256 hash:
593e0e9b77b0fe843cb1dd0f879b7928280f917da00e4415a75f835bdf04e8d2
MD5 hash:
f90558c653e974448c269c08bc56fdd0
SHA1 hash:
95b8b04451ecd2e558e93e3f85dbc542794e2a84
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
SH256 hash:
05aec629dc27cf686a10ff2dafa1dd8969ccc25c27a3fabe6d7ead88c05e5dfc
MD5 hash:
2e44bcd76808919ddaff1043f3ca0574
SHA1 hash:
188c19f44f150bdc5c723cd7a2e337de60c58c3b
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
Parent samples :
f47b5a1548d7d1ecf22e19ea995bb81111132ab5543037903f59acc83316fa1c
e759e4e0ba6d3e577ba3dc31a6ff4af77779a92afef0a7dd1814d23b7fe3ed03
db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb
60755b9a1273f9dc3834df3111a64542a47ea1cb334aa95ae4515476a8b048da
89838c428e6292848d7e8345eee67d50c664b078751c74d7f3db20ebca31c675
069c1a556943461282bfbf8411afc6213a359df9ce4894a80881e45a2ba9bc84
SH256 hash:
371177727d5c64ad0a976db10d172d32e5a2c7621299186d85dea7101d201724
MD5 hash:
0fdadcad944366c3629c5f4a92d170d0
SHA1 hash:
9d3d5af3c7228d3f5772ce0f87915be4b86d74ca
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
SH256 hash:
593e0e9b77b0fe843cb1dd0f879b7928280f917da00e4415a75f835bdf04e8d2
MD5 hash:
f90558c653e974448c269c08bc56fdd0
SHA1 hash:
95b8b04451ecd2e558e93e3f85dbc542794e2a84
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
SH256 hash:
05aec629dc27cf686a10ff2dafa1dd8969ccc25c27a3fabe6d7ead88c05e5dfc
MD5 hash:
2e44bcd76808919ddaff1043f3ca0574
SHA1 hash:
188c19f44f150bdc5c723cd7a2e337de60c58c3b
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
Parent samples :
f47b5a1548d7d1ecf22e19ea995bb81111132ab5543037903f59acc83316fa1c
e759e4e0ba6d3e577ba3dc31a6ff4af77779a92afef0a7dd1814d23b7fe3ed03
db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb
60755b9a1273f9dc3834df3111a64542a47ea1cb334aa95ae4515476a8b048da
89838c428e6292848d7e8345eee67d50c664b078751c74d7f3db20ebca31c675
069c1a556943461282bfbf8411afc6213a359df9ce4894a80881e45a2ba9bc84
SH256 hash:
e759e4e0ba6d3e577ba3dc31a6ff4af77779a92afef0a7dd1814d23b7fe3ed03
MD5 hash:
cfadfb5515950bb1142145daee782701
SHA1 hash:
90d71c10593ee4b7a53c8ee0e412ceb606564c91
Link:
https://www.unpac.me/results/e6972a12-4079-4ae7-9216-fb3ed704a291/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e759e4e0ba6d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e759e4e0ba6d3e577ba3dc31a6ff4af77779a92afef0a7dd1814d23b7fe3ed03

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/410897/

Comments