MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f303f80350d34a05961ace4456cc3408510a36852b94a75e0e9abfcd75f803b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 19


Intelligence 19 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f303f80350d34a05961ace4456cc3408510a36852b94a75e0e9abfcd75f803b6
SHA3-384 hash: c2f7f270e0d4122199ce29b670508c07f94e6f882139f19e3fa84b6572dd40d2d4edba14672794cf96de36bdaf619468
SHA1 hash: 7dc5545ef724b816435f72fb6afc2da47d50ad04
MD5 hash: 3b7ac615e9bdc071b13585be19716c12
humanhash: sink-nuts-pennsylvania-thirteen
File name:SOA.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:660'480 bytes
First seen:2024-11-18 07:45:13 UTC
Last seen:2024-11-18 10:06:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:tJsS/s0yKRAHTdlEF9kFSJs/Z4DtaPKqxOj2PrmO3+mBHfNL/cPXQf7G:7jR0TdlWkYGZSqxkQjPL/4XQf7
TLSH T18DE423444FB87B19EEF66BF5B52825848BF0B2137265F76D2F8284D62752B814E00F27
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
411
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
SOA.exe
Verdict:
Malicious activity
Analysis date:
2024-11-18 08:11:33 UTC
Tags:
evasion exfiltration smtp stealer agenttesla
Link:
https://app.any.run/tasks/84bc08a8-e080-4730-97bc-3c346b6f53ac

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.21701.30303.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=673af1c880d21948b0323f55
Tags:
agenttesla lien
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/673af0be3d0d9f2bf1d88d52/reports/cd73fe12-be86-4eb8-bc08-4c0ecea522f0/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/f303f80350d34a05961ace4456cc3408510a36852b94a75e0e9abfcd75f803b6
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/366ce6c3-0100-4e5b-ac2c-5afcd0a28ee8
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1557422
Signature
.NET source code contains potential unpacker
AI detected suspicious sample
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1557422 Sample: SOA.exe Startdate: 18/11/2024 Architecture: WINDOWS Score: 100 42 mail.starmech.net 2->42 44 api.ipify.org 2->44 62 Found malware configuration 2->62 64 Malicious sample detected (through community Yara rule) 2->64 66 Multi AV Scanner detection for submitted file 2->66 68 7 other signatures 2->68 7 SOA.exe 3 2->7         started        11 BjTxJte.exe 3 2->11         started        13 BjTxJte.exe 2 2->13         started        signatures3 process4 file5 40 C:\Users\user\AppData\Local\...\SOA.exe.log, ASCII 7->40 dropped 70 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->70 72 Injects a PE file into a foreign processes 7->72 15 SOA.exe 16 5 7->15         started        20 SOA.exe 7->20         started        22 SOA.exe 7->22         started        74 Multi AV Scanner detection for dropped file 11->74 76 Machine Learning detection for dropped file 11->76 24 BjTxJte.exe 14 2 11->24         started        26 BjTxJte.exe 11->26         started        28 BjTxJte.exe 11->28         started        30 BjTxJte.exe 13->30         started        32 BjTxJte.exe 13->32         started        34 2 other processes 13->34 signatures6 process7 dnsIp8 46 mail.starmech.net 207.174.215.249, 49712, 49719, 49721 PUBLIC-DOMAIN-REGISTRYUS United States 15->46 48 api.ipify.org 104.26.13.205, 443, 49709, 49718 CLOUDFLARENETUS United States 15->48 36 C:\Users\user\AppData\Roaming\...\BjTxJte.exe, PE32 15->36 dropped 38 C:\Users\user\...\BjTxJte.exe:Zone.Identifier, ASCII 15->38 dropped 50 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->50 52 Tries to steal Mail credentials (via file / registry access) 15->52 54 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->54 56 Tries to harvest and steal ftp login credentials 30->56 58 Tries to harvest and steal browser information (history, passwords, etc) 30->58 60 Installs a global keyboard hook 30->60 file9 signatures10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f303f80350d34a05961ace4456cc3408510a36852b94a75e0e9abfcd75f803b6
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f303f80350d34a05961ace4456cc3408510a36852b94a75e0e9abfcd75f803b6/
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2024-11-18 07:12:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6mb7qa2q2nfalfq2zzcfntbubbiqunuffokkoxqotk7425pyao3a._file
Verdict:
malicious
Label(s):
agenttesla_v4
Create hunting rule
unknown_loader_037
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
error
AgentTesla
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/241118-jly78a1rdz/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Agenttesla family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/52d7b410-ae00-444f-bc50-aa91319b2e8e
Unpacked files
SH256 hash:
ab737fa94d5638dc23955700ae5443fa7a05882c821c51b995935a91e42c3561
MD5 hash:
8ae00a26ba2f9f1d519fd6455db2cb4d
SHA1 hash:
9270d95cc7f7a8d1915de694d54a550b3c683684
Detections:
AgentTesla
Create hunting rule
win_agent_tesla_g2
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/13d91e7f-e22a-42bc-ad8b-99987b540cde/
Parent samples :
6c06c665c435cf95787310f59e984006711d50bf091ae610cb4440abae1448c4
e62255f98543e0bb1abf017af13fd483e1382158021b7edde65fa55c1ad290cf
433327373b99264a0a5f11194a3722e1a53c832e837f0eab264f89306f9e42cb
3029eb76575a110e9bfeadcee488cb4db00d25da6d8529e48d49f2fee0770f80
98b85ee0663117740bdac3c6af9fd2c637206f83be0978b865bc9cce1cc2eb51
6a73ce1fbde07e660aa6713b7e1c20cc34aa6f576d82f2189da9661abaa5211f
9b2a20382a2f0aa6745217b19f51ba20f0e9bf07121ae3ff6aa0ec74850b0507
ca4db0fd02f9a6e22c53d273087156269b720cf0b92140c67cc0cbc9d279cc26
ecbd820686317cc38e97ceac59f26f853bd924695b2d124c4e87f5f48c82bd63
21e7743ee49b00d201af99fbd9fc0a430032f416070834294b12f3ea2c12b48d
ab0d0bb327fcb4f057c64df4d03ac22f606461f5ab86cf0543ace64c30110c35
36136923c9475c273bce4a1c5bff84b565635565a6bf470e6626ea33a4c3a358
ad9b8625f2d2b98ff577f78aaf80cd4ab30b640680135cbb2328a3ffbb1623bb
bd0e1cfd8ac5fef73e78b0a784c11682ed8d3120e6293d7d87425e5cd65d91eb
e0b9c05954186f5d54bcaf95e425448540d4a0fdc6cac1a12899bda66e38ac37
5f9a7f6a183b3966e84173f3ea7fec1ed563e9cd08577d87d523d9f69f66eb8d
0222c1554ceb01925bccffabe846186b951f8b48a9f1731ed25d51c42761826e
1ddb5066864496c4fdb477252d09eee2f3304d5801c93bc9a72acb22eb78523b
cb8e8d185adfffe272bafb00ef1000724beac1e478fba3e50682ac0c2300d0bc
4c2de5043cb67a6805824b096a6640ab47b60c0c1ed71a452d3228144c92b0f3
0989a20ad0aceb20e2199f0bceaec9461f94b49899f7d2cb1ce61d05473f5d1a
cb9790cad0a60c5d06786c99700a84a880c04abf6477ab97453b13ba386306f4
097c7472803e5dca675ac074c1092848ae92cb468447eb8d0b57afe392c156ad
0d7a4a69f12914329cbff3ca263858dac70c0b5afa1657806129e553fd9e246e
8a8794d42a442da3a12f8424a51685fc7da1b9113452b2a5dd1ef23352b5f0b6
4814d2923369ffb5245d01dc4d9854aadd669fed95cfe32c24919256b2176165
4bf19e00f15d689c108b9935716d0f5f34be07e6a08c39dd715bfbe806d99fe9
f303f80350d34a05961ace4456cc3408510a36852b94a75e0e9abfcd75f803b6
4bffa4186f899e3474a07b07fa5caaec795250cfe89d4c24b9369e2da967238f
7abd614a718eae6e0544e6828c834f275248093b5d807b7cc5c4de975dc7abc9
24ce2be70ffbceba0067972a154cba571866cbeca67e2132bc01352f46acd9b6
42c52ed2af4708289cb182a0fd83026691eabc7c4916a3ef0cf8a01b5f890856
e16ed69e1d337d88539ff98cda8d36aabc495db375d68e4f9b86a1843ad8c679
887f393b62c6c4b69e81cfc772397619082d936dd38cbcbc0f54b623ef871af6
487a65a744364c95696bf450fe78819afac41980fb6a106231f84aa0835aa5f2
496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2
b8dbf3db5d56d847b13c3e517dd9e9e396038948ea1189e7f57c419f493c368c
a689d2c7fa2cc3712ff115a0dce0cd90c5d55c92bc87e7f24dcd05ad4a38db63
4bb53e8f6293f4328bc49ed18f542bb729d48f6841c171438e1bd42b02ed23b7
83a7159eda11a47065c266929a9ea0c387be8db616b2d46c75a18c4e473760c8
72c54730956921bbe2e5d9013b3dfdc738a98a2868ace2b85d7becc16ae6e55a
6a48b22bd969313fc663ff3517d4d95c316623f099b68a0b5499cb0bb7f68f0b
SH256 hash:
42845ecc42abd302d832179057f11d269f8c7ce4bf324d256f35f5bca1ca45b6
MD5 hash:
0da34a44ee4876dd5e35939af02f1d32
SHA1 hash:
83109ca5bd5178b9f409a2eeb14dc0763df57729
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/13d91e7f-e22a-42bc-ad8b-99987b540cde/
Parent samples :
6968d52cfb23011d71a62b5b5f7a58f98bf287503af1dbb9d13d21998d1de6ed
ffc6b173f9b255702bdcbe65dd606f6154865c7fea2b2488305ba8f0d9ccef58
990e32f2b58b0c11d9998695169ab6a6b0825fc2c4c70d366eb2197360875edc
f303f80350d34a05961ace4456cc3408510a36852b94a75e0e9abfcd75f803b6
60fc7c50aff42fbe59f51bcec55bd48ef9e78025d471f26051907572cced5ef5
acbd111f6e01f7a02777bf50b95d61a352d476f031e7421f1fb356454a81e4e2
8d8c12c1b96b60a434c003d013e5bd8e948ea049246912b545fef1d3574819f4
4362b2639911cd4589bc5704aa5dac8f47bed2ab7d893b375cb74743ad38c3e1
c169a73ca29094fb2cb53c32f7cddf5fb633494a8e498ef9abb0057a19293155
38d921d063a0fb892086121bb34180b2a930819788a3e34a0d2f65224142d930
d709e53e4afc4e29076812e41282fe82bcf2f3d73abe7016f13a41f432f4bd75
5eabc2ee89814722a4e157224e042211e7780ab450b8ed1f9311f72eb80f4262
f8651bad204cbf1299c8143c5fafb19346e11203273b76483aba23a0c91a6bbf
eaee2e889db67e2b31b9297c371542028cab1b572270e85757a0a4849cd004aa
c997ad9cac5cb1cfc050a066e275aae6a540443075b2641ca19331b3f065ee29
2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9
8e63fcd9e5fcdd993a7535a3990f28a4c95740d801dbfde8fb0d338bbae22d4c
5e8880438f921f4bd81f137cc9b4c44f1ba12b321a178d4d50a0601d75aef049
4bffa4186f899e3474a07b07fa5caaec795250cfe89d4c24b9369e2da967238f
b22bdf76891cde5dd78a3f1dbc7ad67543f9d66db4a959bf3dc70536d8d1903b
9565e0e3358341d167b1adfe5a30b957aa028e19addb4427af1bbd41bfe67e6b
901f5ee695e32164bd5fa37b4d6ee86680c435aafdb9d504864b5d70d3da9983
e70f87d5f05ff21f16c25173755ebb71a2cf2b46c047aa9ad9bbf1e13e2dd3c4
f3246d0ca5ca8e69f98ca33b2c17813d5d862049dcfa9931dbcbaaaf7543a1f7
d6186fa8bede1688696983f91284af10a7d8db6f28387d08c3d125853a0c93ab
76ee39157442dc28e64f089260ca42ec5374ae2fccb99d0940b9717e48e6dc86
43504fb57bd1ac94288d4f43963b862b3bcd530397bd7584f14ade877a31a8c8
6f5c8e04089a2db3aaa4d9447de589e5df8899292fbc70a5ad852d7abc7f174e
d4c86776bcf1dc4ffd2f51538f3e342216314b76cdba2c2864193350654a9aca
05686f0f36d10b7c3056592eba7b16959f1940268ca9979c2312c50b8a73e045
f03acdb2a846f8060d76c3d81651949b5699a5dee5b2b26ec238872defd12252
01921eaf53c9afa578c6abce6daf8fd661d8be6467c589816785ff39f3545503
f69515024de365946c3a58ce3315898196dcca5a2d5a9ba3f5b257818df4055a
2efd54686c3942f7778ae4ad63c002e50d1fd2a08fac36ac770dff40cb3e3788
7bd9596f753e58ba917ba418c191af8fcb9b537e73ee6a86989960099585394f
6474ef699648b5f34d8739a9a102836b27e4dcfe718404fcd09a428d2e89a973
50603d9481c76ac7052a18320666f9206f6729c78fdb779c0e7010952eaede26
819453cf1ae051083e60fc82a6125798ab8f94385d65bb2c1920cb7579df6772
2f5f280877cc85b590b53a0b6c2d061b34a6d23629cca5ea0e0aeb0591ef3b0e
89bf888148eae2caabdc6d3fff98054127b197b402493581894a3104ed6b6f1c
5cce0ced936e5d9c13d6a4a8a3c149371c92236eb4c465e0e422142946509cea
a83b6e776af937398296eb1b06b65e9ea8226693b5a8337f35c8b8e42bebb23b
3f233256d32f8c33884510be0e50b614a35642f6ed7cb76b1f480373b548b295
8c25a42242f041b0ecfc47164ef25a988b37735dac00a6990f7babd80eaa2487
11013cdd71339c3aac7041ef80912c8c03786f5967d58c539af0d560687089e8
8dd1167ef29a5c350fd3004da6a685cf48c6c587dac25fc4786f9fd90284b5b1
402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361
7292590b86e83ca5c6993b8c56578740d1f066c91baf3d95bee2bd34d9153f15
c35b10fc350209ec356b48282d85b18d9b9ab5c0167dc88461297906602e3d61
429e0fa9706ee65774188e538bda0b69a15fb93e97864cedb88e33c650ed9538
10f6d70d363d93fce85e92f2ea94a36eda4c755606581cd101652afaa97a91fc
f6b094d042f1ccc79ef5060b18495c6bee55585630fac2c3d3f32a8c9c174de6
a36c66fb7fdfb2639cc0ccdeaeef4e6c1a1cd103ba76309ed32777b3f2ab069d
c6324c508e3f4ca77de6321a2ba98faec3cb40ab4b9d85a2eced9560f24f6eb9
4aa26829657bbdb5983129321451365832a69fde42f22687b9a7c598f2e04301
ad3517d5640b93e40bc1e839f6616222801d06dd83ed5887462a71f3858f5b40
e115d3bd2903d9d663a7a69edd08b0ba5f2528c831d17530bbf621648b44894c
bba1825bd893328442cb891a35420a5da41a5431d1ade643f085c5992e763d3a
0b06f6a3a4102c27376f21cbcd09d3c0bf5e6cc7e92f9b9a3810fc386ac8184d
bdf6c1caee139afdf9122554e47a2b1f56dd5598447dced5cf81cafac1dfb7a0
c8d717bc9d9c2bd335a79ac5e189d98f36fcd7ab0c62475a7aa7da5fd5ae75d1
941559a78b6e1caf39212048e7f62723e5f283d1942858cc07a339d6d6b24362
cd60ea86b574b6b511ce6a6aff1314ce71b1953e169792e3e76a36913e85ea23
d5d8c33957e90d1caca4b5207d8da5ab1bc4caa9f702abc0ec006d0518ea9aec
096b33571e80d18c1763a3bd5d019e3177f1547b3ca6e6205a349075ce2fec18
efbc15ccbe9e7b1f1648d94c5e38e3149bff5d33ad93c0a56e68db648050509a
98ffb783354435168540dc2e8eb4570f865f324169d553ffbad828bf9f33acd3
59586e753c54629f428a6b880f6aff09f67af0ace76823af3627dda2281532e4
cac29565b48f92e8c7a43b7dcca13294bae02890c26df75ae5e5ee31a464e4f3
2e64ed10f0c61a872dbc4cc8ac023e947db0c9642044dbe33af671cff97135a0
5618efb4038198984ccca27de0dd5850a697038d9f0c2a9ad26b17bb26cc0f7b
9c9405332a044a5f3222dfc59bc8b36a4cd6fc4542c8651667aaf2101bb54ea8
e588a098e9ceb33f2616e11a3faf28162e5f4b7f3800b22ab3023bc376aeb18c
04620fd6c4803006181800a7c9dd8748e37e688d197bc22fc580f6d8400c4d13
744ad803081f6ad2d85f3c667c537c6bc3a47bf95c07f496315171790a1b05a2
b3af9675cef7e3a371e7a3d98d141b2bc6cbbc5da2df140dc09cf918ee3c62da
cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92
1070bf3c0f917624660bef57d24e6b2cf982dce067e95eb8a041586c0f41a095
f0430c66223a7084799e61e0cb4541d034da240965e9aa62f2d6994ece64a5da
fbc1981c8c4b453464e63ea2155aa74d2e6e6da1fd3268fd8b45e16c1d2bd0d2
f57e0e55aa4691d0502f6da67d4ecb2823c98bd319c5208ae44a518a0a17392b
0d29f5c648cbd373d3b46738e2a00917b156053e4eafb1e47481a122cedf0a1e
ba5fae13322d5151dfb348ac1a2abc92d021617c154ef9d1e4efc70bf7fdf03b
5bda0fc048c68899988ae1d18bffe618d76edc0e02abcf3289018ac1038ff420
SH256 hash:
7e12091b1c057a549116040d0effb684cf1e9d3c96383cbe67735529de76c178
MD5 hash:
275469deaff4ada418ed865cef29a28d
SHA1 hash:
5c082c60ef31691bf6b872de34d9539d27b7b500
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/13d91e7f-e22a-42bc-ad8b-99987b540cde/
SH256 hash:
f303f80350d34a05961ace4456cc3408510a36852b94a75e0e9abfcd75f803b6
MD5 hash:
3b7ac615e9bdc071b13585be19716c12
SHA1 hash:
7dc5545ef724b816435f72fb6afc2da47d50ad04
Link:
https://www.unpac.me/results/13d91e7f-e22a-42bc-ad8b-99987b540cde/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f303f80350d3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f303f80350d34a05961ace4456cc3408510a36852b94a75e0e9abfcd75f803b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe f303f80350d34a05961ace4456cc3408510a36852b94a75e0e9abfcd75f803b6

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments