MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd8adf2bd4e0ff18cb663babc52915bd6d4471bbbb2d9305ab4e48f1c6f7dc7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd8adf2bd4e0ff18cb663babc52915bd6d4471bbbb2d9305ab4e48f1c6f7dc7c
SHA3-384 hash: cef3582630971f384401bfc916edc5853e86a2b670fccd795fc1c575203fa2c2f8dd97f87649e833d192db5252801f64
SHA1 hash: 8c55be6a0b2d772772ead87e45667981d2a5254e
MD5 hash: e31c95828b6a85ac74be432f1dc9a9b6
humanhash: friend-lima-twenty-sodium
File name:SecuriteInfo.com.W32.AIDetectNet.01.30317.9472
Download: download sample
Signature AgentTesla
Create hunting rule
File size:744'960 bytes
First seen:2022-06-05 23:42:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:c+heXPKAaT/suDFw9pEBH9paJvoJf01ox3jR:T+eHOHvoJf0O1
Threatray 17'443 similar samples on MalwareBazaar
TLSH T12FF4015E7589A18FC4368D378892CC7527B97D379B67EB47B0D3368E844E2C34A121A3
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
381
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.W32.AIDetectNet.01.30317.9472
Verdict:
Malicious activity
Analysis date:
2022-06-05 23:44:20 UTC
Tags:
agenttesla
Link:
https://app.any.run/tasks/35492e57-f89b-403d-9ebd-aaafa460e648

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/276853/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.30317.9472.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe obfuscated packed remote.exe wacatac
Link:
https://www.filescan.io/uploads/629d3fc2c221aaaa25bcd28e/reports/26604614-9c9f-4fd5-b29e-411cfd93cd81/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a416f9a6-2ea2-4863-b3d9-ceac1a2c4984
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1007031
Signature
Antivirus / Scanner detection for submitted sample
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the hosts file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 639527 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 06/06/2022 Architecture: WINDOWS Score: 100 30 Snort IDS alert for network traffic 2->30 32 Found malware configuration 2->32 34 Malicious sample detected (through community Yara rule) 2->34 36 6 other signatures 2->36 7 SecuriteInfo.com.W32.AIDetectNet.01.30317.exe 3 2->7         started        process3 file4 24 SecuriteInfo.com.W...et.01.30317.exe.log, ASCII 7->24 dropped 38 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->38 40 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->40 42 Injects a PE file into a foreign processes 7->42 11 SecuriteInfo.com.W32.AIDetectNet.01.30317.exe 2 7->11         started        16 SecuriteInfo.com.W32.AIDetectNet.01.30317.exe 7->16         started        18 SecuriteInfo.com.W32.AIDetectNet.01.30317.exe 7->18         started        20 SgrmBroker.exe 7->20         started        signatures5 process6 dnsIp7 28 mail.epico.com.my 103.6.198.160, 49759, 587 EXABYTES-AS-APExaBytesNetworkSdnBhdMY Malaysia 11->28 26 C:\Windows\System32\drivers\etc\hosts, ASCII 11->26 dropped 44 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->44 46 Tries to steal Mail credentials (via file / registry access) 11->46 48 Tries to harvest and steal ftp login credentials 11->48 50 2 other signatures 11->50 22 WerFault.exe 23 9 11->22         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd8adf2bd4e0ff18cb663babc52915bd6d4471bbbb2d9305ab4e48f1c6f7dc7c/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-05 20:09:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7wfn6k6u4d7rrs3ghov4kkivxvwui4n3xmwzgbnljzepdrxx3r6a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
227bc28bccc6a045446b203868d39cfc5170a6b0b6ec31dfc5d2bbf0e1c38f09
AgentTesla
31eab40e6537261b6e790130f4d27d8f54fac94b5900c0ecfc6484625204d326
AgentTesla
424dc6505f7816d2f3f45acd03e87457b2cdde5009754ed030c0c2833f147018
AgentTesla
663451636c9a3ca0013887bcd4433cce5b890f862e9ba01b94d2060d4d4c0c70
AgentTesla
9f3ae2cc905304679d3f6993e602d1e33c8290afb690ac1016cbcce7d85f2aea
AgentTesla
c9559cb55b1cbe6a54ba24443b6210b68effa9845f04926d41aaf29787158705
AgentTesla
+ 17'433 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer suricata trojan
Link:
https://tria.ge/reports/220605-3qjswahehn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla
suricata: ET MALWARE AgentTesla Exfil Via SMTP
Unpacked files
SH256 hash:
0f777ccee9e7b3cb7da5626ead0e7d205fb13534c30740dad8c74c20ace829db
MD5 hash:
fb7fbb87f51de7c4e354d96d9464f245
SHA1 hash:
97d2b60e351125b1daed3ca8facf175c65034a0c
Link:
https://www.unpac.me/results/c1e66b04-9240-43e9-b1e7-ba19848e33df/
SH256 hash:
dc9a8eeb850639cce0bec0b1079a0bebdf4beaaa43ca239fd3b0d3df10f2b0d1
MD5 hash:
47b34993c7faab734adb01340d57fc33
SHA1 hash:
7b4a1291d19c980f11be9295dd9a1dd941f95988
Link:
https://www.unpac.me/results/c1e66b04-9240-43e9-b1e7-ba19848e33df/
SH256 hash:
e9ac4d8d05ba2efff2ec972add4a9077f161f024c301c1b725529b9822fd424e
MD5 hash:
cc0851ea55ab92773f4a0de151edb3c9
SHA1 hash:
2b0546a35cf1dfb54e52b200717f3179a7ed6ce7
Link:
https://www.unpac.me/results/c1e66b04-9240-43e9-b1e7-ba19848e33df/
SH256 hash:
879c29560b21be7d9b69ca27ca4756df86e080fa3e34cb191aad5cb1e5f05504
MD5 hash:
30b6a54a992eae921a2eb8c5ea130911
SHA1 hash:
1c83f0319bffe007077c6656418c9b7344d5affe
Link:
https://www.unpac.me/results/c1e66b04-9240-43e9-b1e7-ba19848e33df/
SH256 hash:
fd8adf2bd4e0ff18cb663babc52915bd6d4471bbbb2d9305ab4e48f1c6f7dc7c
MD5 hash:
e31c95828b6a85ac74be432f1dc9a9b6
SHA1 hash:
8c55be6a0b2d772772ead87e45667981d2a5254e
Link:
https://www.unpac.me/results/c1e66b04-9240-43e9-b1e7-ba19848e33df/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fd8adf2bd4e0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fd8adf2bd4e0ff18cb663babc52915bd6d4471bbbb2d9305ab4e48f1c6f7dc7c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/276853/

Comments