MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f41e8435ed94d40a0225a5f411991f630f1db80fb2df805da76449bf52889ad1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f41e8435ed94d40a0225a5f411991f630f1db80fb2df805da76449bf52889ad1
SHA3-384 hash: b04950b251551fcabe49267474cf5e1cc3f0494892080810ca75863d518a5b6f0842a3b6c33d1b8358e957535518be18
SHA1 hash: a1dd723c1de72ff3146017a789cbd6a56ea533d5
MD5 hash: c339bc586c83d1b770c9493fe29269e2
humanhash: yankee-mango-beryllium-one
File name:c339bc586c83d1b770c9493fe29269e2.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:713'216 bytes
First seen:2023-04-24 14:35:30 UTC
Last seen:2023-05-13 22:48:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:b0gjjnkCS3987z6A6zdfxMInd5QUgq+uPdleJ3pbZV:b0gjjnkCStM6A6zFG5bZ
Threatray 2'515 similar samples on MalwareBazaar
TLSH T1CEE4E164F2092CE2D68B95F2091A63672A1973CE6D3C65947B79B5E121B33CF1F89C03
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
253
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c339bc586c83d1b770c9493fe29269e2.exe
Verdict:
Malicious activity
Analysis date:
2023-04-24 14:46:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ee5b0690-20be-4d6a-9b32-193c97b9a200

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/384598/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/644693db65b697d82a8914d1/reports/dfb895e1-9b26-4080-8e58-7e8766495239/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/f41e8435ed94d40a0225a5f411991f630f1db80fb2df805da76449bf52889ad1
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/29d32c2b-8c24-48a5-a364-112df0ef3955
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1220093
Signature
Found malware configuration
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f41e8435ed94d40a0225a5f411991f630f1db80fb2df805da76449bf52889ad1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-04-23 18:47:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
21 of 37 (56.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6qpiinpnstkauarfux2bdgi7mmhr3oapwlpyaxnhmre36uuitliq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1bfb950deb3e17f180908c445173783b996cd3ef9c3b61b59b8ac67d96bde30d
AgentTesla
64879bdaf4add0db2f52b2cfc4c579b15fa5263601aed7c3aeeb926f0dba1acf
AgentTesla
74c836dfe668140a6936e71347ac8eafd517ec914d7201666081f99c2a6ae846
AgentTesla
b559f2c5da63f93d113863c3328df3db4b81cc1e35cb68989ad06a19b9847014
AgentTesla
baecc5ff2030bae2c7bbefd317d15f0a0c9934e3366993f78f920918b6fa675b
AgentTesla
bd407e66453e00d96368122b1d8761c995aa3a9606995dbd46ec1629debb18ed
AgentTesla
c7db7fa3a5aeba74a3733ed0d0c3a8007c973c122ee73ac0161c2e56d24d1f07
AgentTesla
d40024a841668b3cb64cb894613ee64fb37288125d32ca3068007f70db30f1ed
AgentTesla
d89c98d73846067d4468833805f50a5830208fa4e5512b5144ef764b339b264c
AgentTesla
+ 2'505 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230424-rykvcseb6t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
9f414a8240c47c59a266141247692a20aa4f6da940c16cc9eb1f66904121868f
MD5 hash:
7b8cfd71023586df51d46b0a1655757d
SHA1 hash:
f5d66610eaa4f571bc8518f868003bf3a1e300da
Link:
https://www.unpac.me/results/fb069a1e-9412-40db-9656-befa6d87d24b/
SH256 hash:
40c050c20d957d26b932faf690f9c2933a194aa6607220103ec798f46ac03403
MD5 hash:
c768bac25fc6f0551a11310e7caba8d5
SHA1 hash:
95f9195e959fb48277c95d1dd1c97a4edff7cb3a
Link:
https://www.unpac.me/results/fb069a1e-9412-40db-9656-befa6d87d24b/
SH256 hash:
2138517fe2a67f71da8921b47dbf2bb7a510443d3026d7aba52eb38102dd7425
MD5 hash:
ab991a170761993cb94b8cf0fbe4895e
SHA1 hash:
6b818e4b58a40d8430b80bc820e0d84ca0922607
Link:
https://www.unpac.me/results/fb069a1e-9412-40db-9656-befa6d87d24b/
SH256 hash:
9b19f03f48f6abd177c6237050b0c45171d815778965c607a0d2614a68988668
MD5 hash:
6bfb2a3c132264b6b95cd52613f5f839
SHA1 hash:
400f55a92b9cf55791ab5e90951fa022c81d54b7
Link:
https://www.unpac.me/results/fb069a1e-9412-40db-9656-befa6d87d24b/
SH256 hash:
848e5801501161c60ffd611afdb5550a4954b8a52beaa8c366bd71dfdf3e52f1
MD5 hash:
adbcc989437dfc478a8fa41a484ceb50
SHA1 hash:
258a487116d09ada36388ade4cff20a344090e65
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/fb069a1e-9412-40db-9656-befa6d87d24b/
Parent samples :
c7db7fa3a5aeba74a3733ed0d0c3a8007c973c122ee73ac0161c2e56d24d1f07
f41e8435ed94d40a0225a5f411991f630f1db80fb2df805da76449bf52889ad1
698d82a99f8d7c65b98bafb63690fd54c2ca7f42c9f1d9908095295bb6c84e6d
SH256 hash:
f41e8435ed94d40a0225a5f411991f630f1db80fb2df805da76449bf52889ad1
MD5 hash:
c339bc586c83d1b770c9493fe29269e2
SHA1 hash:
a1dd723c1de72ff3146017a789cbd6a56ea533d5
Link:
https://www.unpac.me/results/fb069a1e-9412-40db-9656-befa6d87d24b/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f41e8435ed94/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f41e8435ed94d40a0225a5f411991f630f1db80fb2df805da76449bf52889ad1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe f41e8435ed94d40a0225a5f411991f630f1db80fb2df805da76449bf52889ad1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2403250/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/384598/

Comments