MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fab587d66022bb63c3c252b36b6ab6a8aff3d2673d1eaa7bfe03d146eb4d9450. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fab587d66022bb63c3c252b36b6ab6a8aff3d2673d1eaa7bfe03d146eb4d9450
SHA3-384 hash: d42fd6e6742d5046f194b7de8242e36c06233f3bbdb74ccc5d3265fa05abc31ae722f12c31d76e68d26b7eb3e703e160
SHA1 hash: 756b5342cc8b78f39d620c87ac9bfd07d44aa76a
MD5 hash: f1d4bfdbff6fd894e4e55e901eaa5334
humanhash: mars-zulu-bulldog-arizona
File name:2021092600983746_pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:232'960 bytes
First seen:2021-09-27 13:23:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 3072:vbPdgg9x4Cu+qhAp08F1GRnN9dfz5AkqKnoeI:vbmgvmhAp08OnNekqKoe
Threatray 10'299 similar samples on MalwareBazaar
TLSH T12534F8873944C59CCF6D55F7A307854433A9DCFFC918A6096BC833579EE6BA20822B1B
File icon (PE):PE icon
dhash icon f2909696969ef66e (42 x AgentTesla, 42 x SnakeKeylogger, 13 x Formbook)
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2021092600983746_pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-09-27 13:25:34 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a7e5f81b-7d45-4f9e-a888-32155087094d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/192107/
Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b3c1d662-f2a9-4ead-bdcd-07756e1c6b5b
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/859001
Signature
.NET source code contains potential unpacker
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 491431 Sample: 2021092600983746_pdf.exe Startdate: 27/09/2021 Architecture: WINDOWS Score: 72 35 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->35 37 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 2 other signatures 2->41 7 2021092600983746_pdf.exe 15 4 2->7         started        process3 dnsIp4 27 store2.gofile.io 31.14.69.10, 443, 49803 LINKER-ASFR Virgin Islands (BRITISH) 7->27 10 powershell.exe 72 7->10         started        13 powershell.exe 7->13         started        15 powershell.exe 7->15         started        17 2 other processes 7->17 process5 dnsIp6 29 facebook.com 157.240.17.35 FACEBOOKUS United States 10->29 19 conhost.exe 10->19         started        31 twitter.com 104.244.42.1 TWITTERUS United States 13->31 21 conhost.exe 13->21         started        33 google.com 172.217.168.14 GOOGLEUS United States 15->33 23 conhost.exe 15->23         started        25 conhost.exe 17->25         started        process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fab587d66022bb63c3c252b36b6ab6a8aff3d2673d1eaa7bfe03d146eb4d9450/
Threat name:
ByteCode-MSIL.Trojan.Dothetuk
Create hunting rule
Status:
Malicious
First seen:
2021-09-27 08:28:58 UTC
AV detection:
22 of 45 (48.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7k2ypvtaek5whq6ckkzww2vwvcx7huthhupku676apiun22nsria._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0da1306ca75347a4387079465ef83befc5027ca4943c08024504175da47301af
AgentTesla
2b9e8dc39755d37c2a78fd00f6fa57414205648e65ae6a6c76c102c7d78e2e86
AgentTesla
9122c256e01d8489721f5a124686ad014bb32fb9d058dc74d966d36381fe01c8
AgentTesla
a2f824423896d08cb0e39cdc6d7782eb2093b5cf6801baef759adb2ae65fbeb3
AgentTesla
b8c22189bd0dbb85f078d3d58774f7a1f7e28d0c304cb3f36de7328b4b4fc442
AgentTesla
cd21f313637dcce24e8ca5cb45937fcbaeade384bb435e215e6abcee06e44757
AgentTesla
ee38c337749db260f84ccad87db5245a2fae65f86d8cd57562c72081d3300f97
AgentTesla
+ 10'289 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210927-qnc64ahag7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
fab587d66022bb63c3c252b36b6ab6a8aff3d2673d1eaa7bfe03d146eb4d9450
MD5 hash:
f1d4bfdbff6fd894e4e55e901eaa5334
SHA1 hash:
756b5342cc8b78f39d620c87ac9bfd07d44aa76a
Link:
https://www.unpac.me/results/dde7734f-8524-4b9b-9e66-4cf54d2cf9fe/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/fab587d66022/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fab587d66022bb63c3c252b36b6ab6a8aff3d2673d1eaa7bfe03d146eb4d9450

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/192107/

Comments