MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea89d821d04aee27aa911b6004ef645d3119e8cf21a60fe180cd27a9b1472034. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea89d821d04aee27aa911b6004ef645d3119e8cf21a60fe180cd27a9b1472034
SHA3-384 hash: 819e75b59444cc1bfce2c3dddc6cfce2b2e9b496530ec70dbaa327acfd6fa924c3cbb7d0d3587d692f11fde93ac23f87
SHA1 hash: f4acc57216fff84590f8ff239beaa34907329d58
MD5 hash: 4ec840f170d033c98eed4fad56d6b6ab
humanhash: sixteen-montana-iowa-carolina
File name:FedEx Receipt_AWB#883053232014374654-pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:655'872 bytes
First seen:2024-01-22 09:57:28 UTC
Last seen:2024-01-25 14:07:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'453 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:/Voo+dfTzSFr+Rge+CC752Tkz3C/DbEpSmTLPx36Hs5q9+TfP0l7h:GurQG0Tm3UIpSmTB68Q+T30lt
Threatray 4'769 similar samples on MalwareBazaar
TLSH T165D4124073FC9B26E2B7D7F226A190400BBE396BA562F31C5DC521CE5871F405BA2B63
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:AgentTesla exe FedEx

Intelligence

File Origin
# of uploads :
3
# of downloads :
325
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/472245/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/65ae3c2afc0458d7ffd5af60/reports/9c08a0fb-dc07-4045-9b41-1f5762c9a69d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ea89d821d04aee27aa911b6004ef645d3119e8cf21a60fe180cd27a9b1472034
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/41dd95bc-5d03-46af-bd94-befe1997830e
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1378635
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ea89d821d04aee27aa911b6004ef645d3119e8cf21a60fe180cd27a9b1472034
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ea89d821d04aee27aa911b6004ef645d3119e8cf21a60fe180cd27a9b1472034/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2024-01-22 09:27:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
27
AV detection:
18 of 24 (75.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ke5qioqjlxcpkurdnqaj33eluyrt2gpegta7ymazut2tmkhea2a._file
Verdict:
malicious
Label(s):
agenttesla_v4
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
0326c4ad07721087e1233d322222f2b787e19f9e795cf6c46d36f6e69d482826
AgentTesla
4addfc44ac782f7f180bae561f244800c583e7fb113b7875fc34819badfe0d3e
AgentTesla
8c6b81a7eb5b33af1522fe1fc4be9b1f30b91934e8246127a61533131cc4c804
AgentTesla
9805cd71abcb329f3de9145eb2be4b2f08a5b90ef450f3cad5bf9a31c2fa6668
AgentTesla
dc282458b7f95a4b266a3ad70bc379f56aa3b4ebaa830524d15f6ea61c2c48aa
AgentTesla
ea89d821d04aee27aa911b6004ef645d3119e8cf21a60fe180cd27a9b1472034
AgentTesla
+ 4'759 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/240122-lzhhqsdffq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
9edd60c8fd3b3a02f8958379488436193ea43f87666e47b3470b85134bc73e9c
MD5 hash:
16e10c49ee1684828b98739281372601
SHA1 hash:
e08795665e0b408ee547351afdf7a2c7513ad698
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/2a142e8c-1341-45b6-a1f0-2f3986821fe2/
SH256 hash:
d63e7a2638c6d43248a2f9c8c038a6a7f7f5976ec328472bbf7ae59a9125634e
MD5 hash:
da56b4672330f14781bb25c3e6e46ebf
SHA1 hash:
a728d403b120b4437bff52e339c05982d720e8c5
Detections:
AgentTesla
Create hunting rule
win_agent_tesla_g2
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/2a142e8c-1341-45b6-a1f0-2f3986821fe2/
Parent samples :
d3b88de9fdc5754205c5604ed9419baa20b22ad2abf2975c181dc1733bd758d6
ea89d821d04aee27aa911b6004ef645d3119e8cf21a60fe180cd27a9b1472034
SH256 hash:
dd3ebaac516948c12c3193c6f4a9454d30c5997bf7c1d1a77bc5a6f3afbe2c1d
MD5 hash:
b77799e2e41bb2bcfbd13bf3f15e2684
SHA1 hash:
a6220442058d4040182f1a46c64fb73cd6217871
Link:
https://www.unpac.me/results/2a142e8c-1341-45b6-a1f0-2f3986821fe2/
SH256 hash:
974ee6968484fefb859c10a3dfcb04f3a2957c653d027664a39a32e04471c9b1
MD5 hash:
5b4db860e4361be55f1c8b203d8d4421
SHA1 hash:
3c5f3dfcae665a1f32dade4b9ce3f589fa5ec670
Link:
https://www.unpac.me/results/2a142e8c-1341-45b6-a1f0-2f3986821fe2/
SH256 hash:
ea89d821d04aee27aa911b6004ef645d3119e8cf21a60fe180cd27a9b1472034
MD5 hash:
4ec840f170d033c98eed4fad56d6b6ab
SHA1 hash:
f4acc57216fff84590f8ff239beaa34907329d58
Link:
https://www.unpac.me/results/2a142e8c-1341-45b6-a1f0-2f3986821fe2/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ea89d821d04a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Windows vault credential objects. Observed in infostealers
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_AgentTesla_ebf431a8
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/472245/

Comments