MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9fb667c1ad88479c4fe0610db4ca19495d70b5cd4b8d86307d7f1e0a24473eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9fb667c1ad88479c4fe0610db4ca19495d70b5cd4b8d86307d7f1e0a24473eb
SHA3-384 hash: 25f148133ed6ff69d7503b9a3d528383e7d6170bf2432f69404a9e71e4276f89ddd6fbca974cba1d6ff6894ef9704d0a
SHA1 hash: 2e5913e52ee54152d20e05f34fe072343b3d705b
MD5 hash: baa1c318edc59d3cb771ed61023c8b8c
humanhash: coffee-missouri-seven-salami
File name:baa1c318edc59d3cb771ed61023c8b8c.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'134'080 bytes
First seen:2021-12-10 08:35:23 UTC
Last seen:2021-12-10 11:20:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:lJCxhTn12L5KGJkXsd3Gbg2RxmhbqResvn5EqzXvMKU3YKj:l8x9n12N2sdWnREqzvn93UZj
Threatray 13'396 similar samples on MalwareBazaar
TLSH T1983523643BFE4B95D97A2BFE942124188775A8571866FB2C1EC270DE14B2F004F78B87
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.mail.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
baa1c318edc59d3cb771ed61023c8b8c.exe
Verdict:
Malicious activity
Analysis date:
2021-12-10 08:40:16 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9ded5e96-235f-4eb9-a3f1-feee11a577c9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/213089/
Detection(s):
SecuriteInfo.com.Trojan.MulDrop19.13895.6794.29881.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
75%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61b31178fa72c81b5b15eeae/reports/e8212b11-c63e-4887-b506-fb0df1267159/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b3045fb5-c372-40c7-827a-8ac7622982da
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/905159
Signature
.NET source code contains potential unpacker
Hides that the sample has been downloaded from the Internet (zone.identifier)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 537633 Sample: FtThMGQhyC.exe Startdate: 10/12/2021 Architecture: WINDOWS Score: 100 51 Multi AV Scanner detection for submitted file 2->51 53 Yara detected AgentTesla 2->53 55 Yara detected AntiVM3 2->55 57 2 other signatures 2->57 6 FtThMGQhyC.exe 3 2->6         started        10 szRba.exe 3 2->10         started        12 szRba.exe 2 2->12         started        process3 file4 33 C:\Users\user\AppData\...\FtThMGQhyC.exe.log, ASCII 6->33 dropped 59 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->59 61 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->61 14 FtThMGQhyC.exe 2 5 6->14         started        19 FtThMGQhyC.exe 6->19         started        21 FtThMGQhyC.exe 6->21         started        63 Multi AV Scanner detection for dropped file 10->63 23 szRba.exe 2 10->23         started        25 szRba.exe 10->25         started        27 WerFault.exe 12->27         started        29 szRba.exe 12->29         started        31 WerFault.exe 12->31         started        signatures5 process6 dnsIp7 39 smtp.mail.com 74.208.5.15, 49819, 587 ONEANDONE-ASBrauerstrasse48DE United States 14->39 35 C:\Users\user\AppData\Roaming\...\szRba.exe, PE32 14->35 dropped 37 C:\Users\user\...\szRba.exe:Zone.Identifier, ASCII 14->37 dropped 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->43 45 Tries to steal Mail credentials (via file / registry access) 14->45 47 Tries to harvest and steal ftp login credentials 14->47 49 2 other signatures 14->49 41 192.168.2.1 unknown unknown 27->41 file8 signatures9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f9fb667c1ad88479c4fe0610db4ca19495d70b5cd4b8d86307d7f1e0a24473eb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-12-10 08:36:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7h5wm7a23cchtrh6ayinwtfbssk5oc242s4nqyyh27y6biseopvq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0c002b81c804e26afef63976610acf9436c4cdc434a1c3e7da36c3db134ef945
AgentTesla
267dfd7ac4d4fea89f968694933f3b4f616e39aa54e98130acd518ef8ef0008c
AgentTesla
cff634048d6a2f51f024be83033493d77290fce66f23e9a1f0c4bcea7c6ae8da
AgentTesla
d3e17c82c0fc551af072e0b8db0eb7c823bd38334d558fd742158ffb7ae21da7
AgentTesla
e72ca1787e3f3d5ee7a6212bb6d816868f121b475dd52e81a281811ad631e07e
AgentTesla
+ 13'386 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/211210-khk2vsfhb4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
8cc7fa56e027f3b9144a631b3b3453bd439c0061d18087b870838bfd2d9b7d54
MD5 hash:
cee4dde0db838ef0b2c67f2731a281df
SHA1 hash:
ffc998b1b5d422dbd4cf3272c9385731ea39dd6f
Link:
https://www.unpac.me/results/1e504c2f-b05d-4ca7-add7-860a74fdc81b/
SH256 hash:
9cd82dba6c55d901ac7d7007b7a04a30146ad7c297400d44f9d96b90c5ca25d4
MD5 hash:
d9477c36da677507cd33c6eef325d694
SHA1 hash:
330dc88b5041ca9edf57542f5a30c37eef6f11b1
Link:
https://www.unpac.me/results/1e504c2f-b05d-4ca7-add7-860a74fdc81b/
SH256 hash:
ea94db0a9d36ee929f71e1a915b85fa695a6b4b2873b552d0ba57c1fc30f6524
MD5 hash:
5d7d1bc2b49438a5238896e790eb87c7
SHA1 hash:
1c683cbfba6370a88bb10421c5810d422a467c5b
Link:
https://www.unpac.me/results/1e504c2f-b05d-4ca7-add7-860a74fdc81b/
SH256 hash:
f9fb667c1ad88479c4fe0610db4ca19495d70b5cd4b8d86307d7f1e0a24473eb
MD5 hash:
baa1c318edc59d3cb771ed61023c8b8c
SHA1 hash:
2e5913e52ee54152d20e05f34fe072343b3d705b
Link:
https://www.unpac.me/results/1e504c2f-b05d-4ca7-add7-860a74fdc81b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f9fb667c1ad88479c4fe0610db4ca19495d70b5cd4b8d86307d7f1e0a24473eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe f9fb667c1ad88479c4fe0610db4ca19495d70b5cd4b8d86307d7f1e0a24473eb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1866438/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/213089/

Comments