MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1d4702560e79b469a93b684001204a80f726894f42f09df5f404bd34e875707. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1d4702560e79b469a93b684001204a80f726894f42f09df5f404bd34e875707
SHA3-384 hash: 41e82e50879e13862ce9b033f39b7fb81e126f23e5d3d37019dea3f54b55eaebc50db9850c2fcf8d39239e4c02e72b1d
SHA1 hash: 22f27f3292389f0c4521087ff274f2e13f28ecd1
MD5 hash: 918c282f11b895b6fb90ed4cdd822d8e
humanhash: colorado-maryland-mirror-california
File name:918c282f11b895b6fb90ed4cdd822d8e.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'202'688 bytes
First seen:2021-12-15 09:50:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'750 x AgentTesla, 19'653 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 24576:PYRwF20f6HJf+pjb3X0a8ztEJQ0/atCLH+9QULDGG:zFzi+jLX0lz8QEalQUnGG
Threatray 13'431 similar samples on MalwareBazaar
TLSH T134450258A368AF25C57F6BF984B0212B47FDA50339A3D77A9D84B1C62E63780CF01953
File icon (PE):PE icon
dhash icon b3b3333969693b3b (69 x Formbook, 63 x AgentTesla, 26 x Loki)
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
milax.gq:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
180
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
918c282f11b895b6fb90ed4cdd822d8e.exe
Verdict:
Malicious activity
Analysis date:
2021-12-15 10:13:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/97803cb0-9257-4220-9fb6-bacb54a76c2b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/214290/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
hacktool obfuscated packed
Link:
https://www.filescan.io/uploads/61b9ba9081d232372002f3fd/reports/9149487b-4cdc-4560-b4ff-3ea147b70b1c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9d0e5922-a7e0-4152-ac0b-eb65d9d89aac
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/907731
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Injects a PE file into a foreign processes
Modifies the hosts file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f1d4702560e79b469a93b684001204a80f726894f42f09df5f404bd34e875707/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2021-12-14 17:12:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
19 of 27 (70.37%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6hkhajla46nungutw2caaeqevahxe2eu6qxqtx27ibf5gtuhk4dq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1b2c180b41a470da3b379291f571dd14860acf99a6b09e0a4aacda9f4fad2909
AgentTesla
698f6787f4dd123d46ee4a815cb68ad7a430180e527716c1e7dd9c662a66f8bb
AgentTesla
8aded772f5733ae6cd66163868e0fc5dac4e3fe4cca89b3e539149615beaa1b8
AgentTesla
cf3f565adf7a9dc89288a2b46726507b84d4978b17facec8b1e684d7de98649d
AgentTesla
d1eadc3e2bb987b3e3f83f9d0041ec5f729ef00c545c913f10d5e69e55593d75
AgentTesla
fefb2946d721f2f8149ce1291c33bbd13d31590c573d0b0d3838824a76327154
AgentTesla
+ 13'421 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/211215-lvg2eahcb6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
751ef9c48e45495d1086d3e28cd010195d2dea87e1a884df6724d20f5a094fe8
MD5 hash:
c897ae5834d43dcae5e741bd2a37191d
SHA1 hash:
ff3b46dc637d553da42d05267f6f6b84b961dd74
Link:
https://www.unpac.me/results/224faef3-4c09-4f01-874c-d8038ab7e7fb/
SH256 hash:
e9dbe50d1159b74e3772487313fa3666bd0342effa00165d02ffbd0c0593833d
MD5 hash:
85f0547176420acff5c164e997dfd3a0
SHA1 hash:
b0651ac64eefcde1950910fa9357e0836123b168
Link:
https://www.unpac.me/results/224faef3-4c09-4f01-874c-d8038ab7e7fb/
SH256 hash:
bd91da933f92a0add86273be320bdd3e51659d187f1b92bf59ac80c3e55a56c7
MD5 hash:
66091876e4e4aed2cfbe37a60f6902f1
SHA1 hash:
668d9c7997979cb950c14d8868b08b1cd8a8b38d
Link:
https://www.unpac.me/results/224faef3-4c09-4f01-874c-d8038ab7e7fb/
SH256 hash:
f1d4702560e79b469a93b684001204a80f726894f42f09df5f404bd34e875707
MD5 hash:
918c282f11b895b6fb90ed4cdd822d8e
SHA1 hash:
22f27f3292389f0c4521087ff274f2e13f28ecd1
Link:
https://www.unpac.me/results/224faef3-4c09-4f01-874c-d8038ab7e7fb/
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/f1d4702560e7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/f1d4702560e79b469a93b684001204a80f726894f42f09df5f404bd34e875707

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe f1d4702560e79b469a93b684001204a80f726894f42f09df5f404bd34e875707

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1881596/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/214290/

Comments