MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8b020b127ad6e962e62fb0e896f7bdad3449249b07a67815dde796ce2577912. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 5 File information Comments

SHA256 hash:	e8b020b127ad6e962e62fb0e896f7bdad3449249b07a67815dde796ce2577912
SHA3-384 hash:	18c89f2f557a120de4ab2f58439f45a391ae674e25ca146b6d3ddef322e05da4e847b3bd1a7ddd91d9cb1a0b4a18592f
SHA1 hash:	a7461ef851832825d296da26614d067166b50067
MD5 hash:	0ef8b825aa4cb3524e950ed29b7ab385
humanhash:	robin-zebra-hydrogen-fix
File name:	0ef8b825aa4cb3524e950ed29b7ab385.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	532'424 bytes
First seen:	2021-09-01 18:32:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b462095fea3219e285e54ac0547eead6 (5 x AgentTesla, 4 x QuasarRAT, 1 x YoungLotus)
ssdeep	12288:mH62zwMJz7bLg0EKsWmAhndfnZs8svfozjC:z2zXeQsWmAhBIvfozjC
Threatray	5'662 similar samples on MalwareBazaar
TLSH	T138B4CF39F7908D32C17B2A388CEAD1644975B7911E35F9463EE84C5C4A27BC2BD1938B
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

AgentTesla SMTP exfil server:

Intelligence

File Origin

# of uploads :

# of downloads :

282

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

0ef8b825aa4cb3524e950ed29b7ab385.exe

Verdict:

Malicious activity

Analysis date:

2021-09-01 18:35:06 UTC

Tags:

evasion

Link:

https://app.any.run/tasks/c507907e-bc6f-43f7-8ff2-ce097aca87df

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/184552/

Detection(s):

Win.Malware.Razy-9889631-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

DNS request

Connection attempt

Sending an HTTP GET request

Launching the default Windows debugger (dwwin.exe)

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/43813eb6-e600-4bd1-b728-a22b37de4595

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/843598

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e8b020b127ad6e962e62fb0e896f7bdad3449249b07a67815dde796ce2577912/

Threat name:

Win32.Trojan.Phonzy

Status:

Malicious

First seen:

2021-09-01 06:08:56 UTC

AV detection:

18 of 28 (64.29%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5cycbmjhvvxjmltc7mhis3333ljujesjwb5gpak53z4wzysxpeja._file

Verdict:

unknown

AgentTesla

318ca24fe3ce059c1fdd9dccfc9b9c2ef7266966894f4f24d1af549bc4107886

AgentTesla

635eb39e1cfce400a91e879a4278b2c1bba9d2f5e49ac18f44f077dad7abd8d1

AgentTesla

650cd6fd43fbe90cc4982fcc79a26859bb03b27e4f362b06cee50b623c48b10b

AgentTesla

ad8e4031c8f2c544a2ca6bb64ebc98f82acacde9cc819f1c36b11a4311a30195

AgentTesla

d5f329e696bff2eeb46fc94907f1a4ee9694dee87e036ef1f1d20deece4d3974

AgentTesla

+ 5'652 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/210901-p4w441hmcj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Looks up external IP address via web service

Unpacked files

SH256 hash:

dadca335ab25517609326de40001ea5aaeb0bfa1139f3458df26b07209dc121b

MD5 hash:

5f2a0d681844db68511822247258b551

SHA1 hash:

8fc493af235064349122c82d6bdfb010762734c3

Link:

https://www.unpac.me/results/c5393a72-f36f-4332-8f58-c65244c17af5/

SH256 hash:

e8b020b127ad6e962e62fb0e896f7bdad3449249b07a67815dde796ce2577912

MD5 hash:

0ef8b825aa4cb3524e950ed29b7ab385

SHA1 hash:

a7461ef851832825d296da26614d067166b50067

Link:

https://www.unpac.me/results/c5393a72-f36f-4332-8f58-c65244c17af5/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e8b020b127ad6e962e62fb0e896f7bdad3449249b07a67815dde796ce2577912

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_Enigma Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Enigma

Rule name:	INDICATOR_EXE_Packed_Loader Create hunting rule
Author:	ditekSHen
Description:	Detects packed executables observed in Molerats

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	MAL_Unknown_PWDumper_Apr18_3 Create hunting rule
Author:	Florian Roth
Description:	Detects sample from unknown sample set - IL origin
Reference:	Internal Research

Rule name:	Quasar_RAT_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf