MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb94b3a9d0c4cd649911af985e6d82a66c36c1436723eccd3dc7b8fc66dfe8bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb94b3a9d0c4cd649911af985e6d82a66c36c1436723eccd3dc7b8fc66dfe8bb
SHA3-384 hash: c17eaa3e823bf07027056df23a1f32f79868c3a9a4046cfa6b8634f91ce732a13e85c5ff377a0df2e977b76c45d9b126
SHA1 hash: b10c2840d81545b0056d4977788ca6c8b6c1d47d
MD5 hash: ff44f2bc1cdb839d0164f15d4e8b5187
humanhash: table-oscar-rugby-glucose
File name:2022539611 DMO 1.SİPARİŞ OZAKYEL MEDIKAL AS.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'031'168 bytes
First seen:2022-10-11 07:34:22 UTC
Last seen:2022-10-18 07:25:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:tswJ7logcsnGRaQPUKV7xIvVT/uZd6VxCG3LvpgGf4z9nu4Y6G4AQSQy4A:3lrxu7KRuwR9gs4zRdTAtQy4A
Threatray 20'184 similar samples on MalwareBazaar
TLSH T1B1258C7E1A894607E8293274C493D2F32AFBAD606061D1CB5AD72F6FBC512BF9503346
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon d092989899a9a1c9 (16 x AgentTesla, 3 x RemcosRAT, 2 x SnakeKeylogger)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/318803/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.44941.21784.29796.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/63451ca71565eeb6424f4d1b/reports/4306e5c4-a47a-4b38-a7cc-74ad57083cb9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/28ccedfe-8233-44d8-b509-c32b6de01548
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1087743
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Moves itself to temp directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 720322 Sample: 2022539611 DMO 1.S#U0130PAR... Startdate: 11/10/2022 Architecture: WINDOWS Score: 100 48 Snort IDS alert for network traffic 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 Multi AV Scanner detection for dropped file 2->52 54 15 other signatures 2->54 7 RaugGv.exe 5 2->7         started        10 2022539611 DMO 1.S#U0130PAR#U0130#U015e OZAKYEL MEDIKAL AS.exe 7 2->10         started        process3 file4 56 Multi AV Scanner detection for dropped file 7->56 58 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 7->58 60 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->60 66 2 other signatures 7->66 13 RaugGv.exe 7->13         started        18 schtasks.exe 7->18         started        36 C:\Users\user\AppData\Roaming\RaugGv.exe, PE32 10->36 dropped 38 C:\Users\user\...\RaugGv.exe:Zone.Identifier, ASCII 10->38 dropped 40 C:\Users\user\AppData\Local\Temp\tmpC3D.tmp, XML 10->40 dropped 42 2022539611 DMO 1.S... MEDIKAL AS.exe.log, ASCII 10->42 dropped 62 Adds a directory exclusion to Windows Defender 10->62 64 Injects a PE file into a foreign processes 10->64 20 2022539611 DMO 1.S#U0130PAR#U0130#U015e OZAKYEL MEDIKAL AS.exe 15 2 10->20         started        22 powershell.exe 21 10->22         started        24 powershell.exe 20 10->24         started        26 schtasks.exe 1 10->26         started        signatures5 process6 dnsIp7 44 C:\Users\user\AppData\...\tmpG347.tmp (copy), PE32 13->44 dropped 68 Tries to steal Mail credentials (via file / registry access) 13->68 70 Tries to harvest and steal browser information (history, passwords, etc) 13->70 72 Installs a global keyboard hook 13->72 28 conhost.exe 18->28         started        46 api.telegram.org 149.154.167.220, 443, 49698, 49699 TELEGRAMRU United Kingdom 20->46 74 Moves itself to temp directory 20->74 30 conhost.exe 22->30         started        32 conhost.exe 24->32         started        34 conhost.exe 26->34         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb94b3a9d0c4cd649911af985e6d82a66c36c1436723eccd3dc7b8fc66dfe8bb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-10-11 07:35:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5oklhkoqytgwjgirv6mf43mcuzwdnqkdm4r6ztj5y64pyzw75c5q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3a5d374e2a5ab0e6b9586c7568736c13f27f162a9a08d76e20b0112cbc71a020
AgentTesla
40eacf74e5f8d9b40c3a70ba66a6c30deee60c2843f94fe387ccb0dbb7a2cd59
AgentTesla
69ca3b794c4faf2dbf082983793d0fbfbea3f957e758e8512ccd01c3abed13fa
AgentTesla
8d0e75998dfcadec6f3270336a1a4044d879629db57a0e4d42f9f3d6f0899d96
AgentTesla
a11dec6fb979c85a9709903d66713f682c3ea031480b2e80cfb289b8073b1a43
AgentTesla
c01185f1a241bfb7548e064b58b752fa42aaddf07620be347f9f33f632539178
AgentTesla
d0f425d632246499581adac0452d9c38cb2076b9708760660e1256c974caf1a8
AgentTesla
d90f06ec13405a3f787c94a63aed2f17119d476e951f0c97e55597b27b4f687a
AgentTesla
+ 20'174 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion
Link:
https://tria.ge/reports/221011-jeng5sccb7/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Maps connected drives based on registry
Checks BIOS information in registry
Checks computer location settings
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/76944a47-6e06-418c-8c74-94245a1e6f74
Unpacked files
SH256 hash:
161903f7d5633a0cdc5d416c229e1af16ad3f5a6d11dbe8d500aa9151a273f62
MD5 hash:
b460e7cd67e88a80f0b65f65d28b1c4c
SHA1 hash:
fef017687483cf2b5b9d5f8061b6f0645fdcf779
Link:
https://www.unpac.me/results/603249a5-dbd7-4b22-91f9-e03e9f5eccb9/
SH256 hash:
af7ac1171b44c9a949ad80bfaf05095048d0b74cfb527f66479e22f47d340110
MD5 hash:
f696dc0e00cb8f70799ac3fcaa5f9f6a
SHA1 hash:
cde2283de5b89639ea52f6388feef8f77efc63ce
Link:
https://www.unpac.me/results/603249a5-dbd7-4b22-91f9-e03e9f5eccb9/
SH256 hash:
10fbf76f5b6f715fc3c136103b5e4b757d184fd2b77d64fc5304c36eaea063d1
MD5 hash:
6894612b52ce435495ea7e5ee9415add
SHA1 hash:
bd772aaee326db17ff27df0359f77c8091c2914a
Link:
https://www.unpac.me/results/603249a5-dbd7-4b22-91f9-e03e9f5eccb9/
Parent samples :
025a8321c88613c46fdd67037840f52968d82f623653d56baf67799ebf830611
f2d1383495b3d3b154505fbb97ddb06c01c100d30f7828e71a032db0acbc4a26
08147a0de0bb290829a48536b659527ee1a3c6017df1d1d911f79fd76c0ff859
430b243c159c1263e0dec6b0f332193351d15e723c5d413dadca8c240107f6da
76a2ccfcef756d91adaa6ee5e31af66c87daf0f35062b1e081c25d41aee44f3a
bf670829499b37ad382f284f9dfdcc58df3862f419f070b0c13ec3377f0dfb88
f030a4a82db3734a227b011d76767f6f8b9031ea4666aff7b42d8e0d69d6acea
6f0c010a3563a788cef8ac63c83c7c4f41c5a5834cccf80a907de0216cbc003b
506e064c3d6d2932d75e5209e848eb989c8790eccf85d96001d809234560cbd6
c7f0e4ce6d95ce821671196d361bcd2eb1ac9f6837fd4693968fda7b4f926eac
99f8b58cc35942ee1263c39d53425a6317ca0ded571c82539398e7f1822d20c4
24c69122ace7d707b1838376111192f2bcdbd02531521b656536773b8bc4710c
8048311a5b5bd201679951dc13b0e8d156010f37dda2ceb0396b703fa4ff38c3
5762d98de35eb91afb9d86bad2f0c88e31732dffe13f187667b43a66e33f7e07
3a6d7351d110df11fde83df14b50d25a56ac64ec89dcf19fe093d96557058360
856c8bb75c2b8c79b99f9249c201d20838251a94a4f830afa7995a3af0952842
8b5fdd54d03568aa937bc3e4bebb8972f40860192f38348e0cd97f61f8ab00f7
b9fc651bcd9745a7fe9aafe13a13e3280f22aa10a50a6b54edc908f783f5fdcf
c34595b336cffa1c3c6cf48b44a4a988c213e882a647bef9f887fc6c3a3fd51b
320c4584c3d392006ef443e5743123a45909fbae309c7561ced8fac11e11e5d3
91ae2bc0f6faac51d7cd9c8c8edf0a2d4bfb5e16c3c4e3c221ff4d50925cfd7d
c0d2175379d5613de7a562df8a96a3aa3a9c1b740380aa4a43026a534fc39ef9
34c9273e2941aa8a91c0d15c86799e87a8d3bd39dd16d90c8df3421ac014a10b
f84d789635e636040055b6e95077408820a412d66bb66934112a004ac24d9eba
a5e39f16cb3dec0b3e2b6fe876bbfa1805f2266011289cf24864b3b85d9e5561
b2eb42a73b2d0577b927a7e2f287262116d8b0962e975d66ae7c1f2dc50626a2
744d97984aa09fc2b01b43e56e0c76705031f79a4007e1ea88251b6dde4ccf76
9f6374c06e596c5507f375bd2f58e0cb52ecfeb47a2edaf3171456f5c6cc9552
a4a24aead00b96a54acdbaa7566f511561c7eb1ca918bdfa8e92a6380e0199aa
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
2974ae3c88a7395eb508e144a3efc57f2dd86be881396bf48b5db5463ada1d51
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
11be7cf9279c9dd3f8584bfafe98ed1aae2d278d3a1e2009203dbac56967cc99
SH256 hash:
55f202a2de0aa612abca6152a7695dc170d2d14c0ae6eb28539767f34c0fdd5a
MD5 hash:
243f77ce1fd7e506fa2a57f38182d5ad
SHA1 hash:
2f675033e440293fd2137948dfd5c3b7b2129baf
Link:
https://www.unpac.me/results/603249a5-dbd7-4b22-91f9-e03e9f5eccb9/
SH256 hash:
f0d1ea5b87e00b81e77e29e43d744600a84a9a1b0bab89fe184d6e2dcc408e93
MD5 hash:
314d7db032607b0aa7819778bf7be6bc
SHA1 hash:
0a80ca9a97774f54fef20bcd6438e45062e6b0eb
Link:
https://www.unpac.me/results/603249a5-dbd7-4b22-91f9-e03e9f5eccb9/
SH256 hash:
eb94b3a9d0c4cd649911af985e6d82a66c36c1436723eccd3dc7b8fc66dfe8bb
MD5 hash:
ff44f2bc1cdb839d0164f15d4e8b5187
SHA1 hash:
b10c2840d81545b0056d4977788ca6c8b6c1d47d
Link:
https://www.unpac.me/results/603249a5-dbd7-4b22-91f9-e03e9f5eccb9/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/eb94b3a9d0c4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eb94b3a9d0c4cd649911af985e6d82a66c36c1436723eccd3dc7b8fc66dfe8bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe eb94b3a9d0c4cd649911af985e6d82a66c36c1436723eccd3dc7b8fc66dfe8bb

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/318803/

Comments