MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2f2b8311ae29529023545800103c4e1a163106f939e758f3030f4b6af40a349. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2f2b8311ae29529023545800103c4e1a163106f939e758f3030f4b6af40a349
SHA3-384 hash: d4a1a7d289fc5da8d8dbf98382523d047b8c6935780f530488083f14d4de04d08c9bf810c7a341859ac505955ae3cf85
SHA1 hash: 82002f1723fac133f78ca73e9a6fe77567634083
MD5 hash: f5aab858f862a626e548e81d6ed05b35
humanhash: sodium-stream-florida-five
File name:SecuriteInfo.com.Win32.PWSX-gen.11772.22609
Download: download sample
Signature AgentTesla
Create hunting rule
File size:961'536 bytes
First seen:2022-11-09 06:41:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:gmsmYmsmGeJ0AC/ko6s+FrsX2pz73io3F93B:gmsmYmsmB1AEdsX2pSoV9
Threatray 21'373 similar samples on MalwareBazaar
TLSH T1C015D02817A4595AE57F4BB9D0504060D374E21AE25FEB6D0AD820FC8E737239C6B3DB
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.11772.22609
Verdict:
Malicious activity
Analysis date:
2022-11-09 06:42:52 UTC
Tags:
trojan rat agenttesla opendir stealer
Link:
https://app.any.run/tasks/d16a7947-3a39-419d-ab48-047f471048f5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/330998/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.11772.22609.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/636b4bbd4834ec1f25eebb29/reports/07343016-e084-412e-a61f-dc2b839a8b81/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/515063ce-9878-4001-9ede-d3d092c46971
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1108980
Signature
Antivirus detection for URL or domain
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2f2b8311ae29529023545800103c4e1a163106f939e758f3030f4b6af40a349/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-11-09 01:56:02 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6lzlqmi24kkssarviwaaca6e4gqwgedpsophldzqgd2lnl2auneq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1969ef2785557b7ef71514305c4ac60f913089b3db51e49b896d26a9bc7bc3f8
AgentTesla
a0b715dbe6410280098b511f7cf95b466c14f15de32ed2cd79744d2ebd7ad8ff
AgentTesla
a63df56777dee301cd34280144b498d17c8e7c0ccf057224abf73cab1b220b68
AgentTesla
abe9339cbaa7e85ee67e130dafa15f9e8d1bc7fc43fa8a980a9eec144db986f1
AgentTesla
c05b7b394c6fd0211f67dae500bd48d89b0ce2d16ff2088ca657b1fed475599d
AgentTesla
da3907286f538586573df79364298076e3e1605daadc7de588e57fe1544604df
AgentTesla
dfaf97d53abf5a5beb3f87f6a427a0329d4916495de13c605c2dbd7084a7cafe
AgentTesla
fc770cf10f538ed1ee6db0d1bcb6d8119199acdc947730a56b10bf46e0dcb5dd
AgentTesla
+ 21'363 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/221109-hgcb8agban/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
http://85.31.46.78/br/inc/72e09ce2994c66.php
Unpacked files
SH256 hash:
58e51d65ad85fbec2669cf6931d0b46ef08322802ee2879a307c01c5f73d4953
MD5 hash:
418aea71cf575a37f8b9d55413d1b30d
SHA1 hash:
e144ba97ff4dc6cf38a39869e9afff63565f9804
Link:
https://www.unpac.me/results/ce0e9200-d3c1-47b3-b1fe-16b5edf14893/
SH256 hash:
d29e004b926a08268be731987f35385015dda6e5ec2c99bf7e351e093d2de902
MD5 hash:
0d8bd96820b19761cc5a9913d7a8294d
SHA1 hash:
87192e7a7494c8f3a460d3bae65976db4863a2ea
Link:
https://www.unpac.me/results/ce0e9200-d3c1-47b3-b1fe-16b5edf14893/
SH256 hash:
cfc16a2dbb933b1b85807d48966e9301b9fc34f4c44e7357713ca88b54bf4ab4
MD5 hash:
aabd0bdc81026ade6c57383f21d5c227
SHA1 hash:
4b26936bb8c03be6d7963184215a5ab594ecb765
Link:
https://www.unpac.me/results/ce0e9200-d3c1-47b3-b1fe-16b5edf14893/
SH256 hash:
1a52a7d24c7145d9ec1bd3c02f9d4025162eae2dcbada0d22d4651fb0de80784
MD5 hash:
da80f4f1bc2f5b5d1bbfe78587be567a
SHA1 hash:
278efd29fdbe4e41e8c6ecb793b1bdf613153802
Link:
https://www.unpac.me/results/ce0e9200-d3c1-47b3-b1fe-16b5edf14893/
SH256 hash:
ab19f28c700d64814b0c55df868c30dfb94e0a1f9fb6f7bca05bac6eb78a4e52
MD5 hash:
1f2a6c02dcf9aa00a28a5039fb5b8ce0
SHA1 hash:
1ef480867d39b98368af7586a8e6ba38c0c3893a
Link:
https://www.unpac.me/results/ce0e9200-d3c1-47b3-b1fe-16b5edf14893/
SH256 hash:
f2f2b8311ae29529023545800103c4e1a163106f939e758f3030f4b6af40a349
MD5 hash:
f5aab858f862a626e548e81d6ed05b35
SHA1 hash:
82002f1723fac133f78ca73e9a6fe77567634083
Link:
https://www.unpac.me/results/ce0e9200-d3c1-47b3-b1fe-16b5edf14893/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f2f2b8311ae2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f2f2b8311ae29529023545800103c4e1a163106f939e758f3030f4b6af40a349

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/330998/

Comments