MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd9dbcc0a59475ba77d799f67faeefe4264cbdec6b1a45180bd6104568a5ac52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 20


Intelligence 20 IOCs YARA 32 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd9dbcc0a59475ba77d799f67faeefe4264cbdec6b1a45180bd6104568a5ac52
SHA3-384 hash: 209bfa236c19f5a541dfffbf0bf2248fd4a34d9876b0bb742867c58f86c205ad71083126ef9e8f22a31fde86138f67cf
SHA1 hash: 83aadb421ca5c9b9c8d2ecb27f6c37561dc67f9b
MD5 hash: 7fd736963b459959ed27edcc9d852a94
humanhash: twelve-beryllium-blossom-robin
File name:RFD98765456700087670002.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'372'101 bytes
First seen:2025-08-25 07:06:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 98f67c550a7da65513e63ffd998f6b2e (21 x SnakeKeylogger, 13 x MassLogger, 11 x CryptOne)
ssdeep 24576:K5xolYQY675EmXFtKaL4/oFe5T9yyXYfP1ijXdaCqszFv83:dYCPVt/LZeJbInQRaCqH
TLSH T16355BF0377809026FEA791B20E56F662677C7D220663ED0F13941E7ABD70063A27E767
TrID 44.4% (.EXE) Win32 Executable Microsoft Visual Basic 6 (82067/2/8)
23.3% (.EXE) InstallShield setup (43053/19/16)
16.9% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
5.7% (.EXE) Win64 Executable (generic) (10522/11/4)
2.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
backup-message-10.149.147.133_9045-16996129.eml
Verdict:
Malicious activity
Analysis date:
2025-08-25 05:52:05 UTC
Tags:
attachments attc-html attc-arch arch-exec evasion stealer ultravnc rmm-tool agenttesla ftp exfiltration
Link:
https://app.any.run/tasks/f9e8218c-9253-4648-9f8b-720544c17197

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/23355/
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Win.Malware.Swisyn-7610494-0
Create hunting rule

Win.Virus.Sality-6335700-2
Create hunting rule

Win.Malware.Swisyn-9942393-0
Create hunting rule

Win.Trojan.VBGeneric-6735885-0
Create hunting rule

Win.Virus.Sality-6747602-0
Create hunting rule

SecuriteInfo.com.Trojan.Siggen6.54687.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68ac0b7ce9d9dbcfd96dee99
Tags:
autorun autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file
Creating a process from a recently created file
Creating a file in the %temp% directory
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Enabling the 'hidden' option for recently created files
Launching a process
Setting a keyboard event handler
Setting a global event handler
Creating a file in the %AppData% directory
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Launching a service
Changing a file
Setting a single autorun event
Launching the process to create tasks for the scheduler
Stealing user critical data
Enabling autorun by creating a file
Unauthorized injection to a system process
Enabling autorun
Enabling a "Do not show hidden files" option
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit explorer lolbin overlay overlay visual_basic
Link:
https://www.filescan.io/uploads/68ac0bbb7137d684583ae818/reports/e39cafef-af7a-431d-9b09-c353e0fe05f1/overview
Verdict:
Malicious
Labled as:
Trojan.Swisyn
Link:
https://www.hybrid-analysis.com/sample/fd9dbcc0a59475ba77d799f67faeefe4264cbdec6b1a45180bd6104568a5ac52
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-08-25T01:01:00Z UTC
Last seen:
2025-08-25T01:01:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/fd9dbcc0a59475ba77d799f67faeefe4264cbdec6b1a45180bd6104568a5ac52/results?tab=lookup
Malware family:
MOFKSYS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/11449354-2c70-4756-96c5-057655906f4d
Result
Threat name:
CryptOne, AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1764295
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Binary is likely a compiled AutoIt script file
Changes security center settings (notifications, updates, antivirus, firewall)
Check if machine is in data center or colocation facility
Contains functionality to log keystrokes (.Net Source)
Creates an undocumented autostart registry key
Detected CryptOne packer
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Drops VBS files to the startup folder
Found API chain indicative of sandbox detection
Found malware configuration
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Drops script at startup location
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Interactive AT Job
Sigma detected: Suspect Svchost Activity
Sigma detected: System File Execution Location Anomaly
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1764295 Sample: RFD98765456700087670002.exe Startdate: 25/08/2025 Architecture: WINDOWS Score: 100 86 ftp.antoniomayol.com 2->86 88 antoniomayol.com 2->88 90 8 other IPs or domains 2->90 104 Suricata IDS alerts for network traffic 2->104 106 Found malware configuration 2->106 108 Malicious sample detected (through community Yara rule) 2->108 110 16 other signatures 2->110 12 RFD98765456700087670002.exe 1 4 2->12         started        16 svchost.exe 2->16         started        18 explorer.exe 2->18         started        20 4 other processes 2->20 signatures3 process4 dnsIp5 76 C:\Users\user\...\rfd98765456700087670002.exe, PE32 12->76 dropped 78 C:\Users\user\AppData\Local\icsys.icn.exe, PE32 12->78 dropped 146 Installs a global keyboard hook 12->146 23 icsys.icn.exe 4 12->23         started        27 rfd98765456700087670002.exe 6 12->27         started        148 Changes security center settings (notifications, updates, antivirus, firewall) 16->148 92 127.0.0.1 unknown unknown 20->92 file6 signatures7 process8 file9 70 C:\Windows\System\explorer.exe, PE32 23->70 dropped 128 Antivirus detection for dropped file 23->128 130 Drops executables to the windows directory (C:\Windows) and starts them 23->130 132 Drops PE files with benign system names 23->132 134 Installs a global keyboard hook 23->134 29 explorer.exe 3 67 23->29         started        72 C:\Users\user\AppData\Local\...\lards.exe, PE32 27->72 dropped 136 Binary is likely a compiled AutoIt script file 27->136 34 lards.exe 27->34         started        signatures10 process11 dnsIp12 98 vccmd01.zxq.net 51.81.194.202, 443, 49725, 49726 OVHFR United States 29->98 100 googlecode.l.googleusercontent.com 142.251.111.82, 49713, 49728, 49731 GOOGLEUS United States 29->100 102 2 other IPs or domains 29->102 80 C:\Windows\System\spoolsv.exe, PE32 29->80 dropped 82 C:\Users\user\AppData\Roaming\mrsys.exe, PE32 29->82 dropped 150 Antivirus detection for dropped file 29->150 152 System process connects to network (likely due to code injection or exploit) 29->152 154 Creates an undocumented autostart registry key 29->154 162 2 other signatures 29->162 36 spoolsv.exe 3 29->36         started        84 C:\Users\user\AppData\Roaming\...\lards.vbs, data 34->84 dropped 156 Binary is likely a compiled AutoIt script file 34->156 158 Drops VBS files to the startup folder 34->158 160 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 34->160 164 3 other signatures 34->164 40 RegSvcs.exe 34->40         started        file13 signatures14 process15 dnsIp16 68 C:\Windows\System\svchost.exe, PE32 36->68 dropped 112 Antivirus detection for dropped file 36->112 114 Multi AV Scanner detection for dropped file 36->114 116 Drops executables to the windows directory (C:\Windows) and starts them 36->116 124 2 other signatures 36->124 43 svchost.exe 129 4 36->43         started        94 antoniomayol.com 162.241.62.63, 21, 44618, 49721 UNIFIEDLAYER-AS-1US United States 40->94 96 ip-api.com 208.95.112.1, 49718, 49735, 80 TUT-ASUS United States 40->96 118 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 40->118 120 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 40->120 122 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 40->122 126 3 other signatures 40->126 file17 signatures18 process19 file20 74 C:\Users\user\AppData\Local\stsys.exe, PE32 43->74 dropped 138 Antivirus detection for dropped file 43->138 140 Detected CryptOne packer 43->140 142 Creates an undocumented autostart registry key 43->142 144 3 other signatures 43->144 47 spoolsv.exe 43->47         started        50 at.exe 43->50         started        52 at.exe 43->52         started        54 21 other processes 43->54 signatures21 process22 signatures23 166 Installs a global keyboard hook 47->166 56 conhost.exe 50->56         started        58 conhost.exe 52->58         started        60 conhost.exe 54->60         started        62 conhost.exe 54->62         started        64 conhost.exe 54->64         started        66 18 other processes 54->66 process24
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/fd9dbcc0a59475ba77d799f67faeefe4264cbdec6b1a45180bd6104568a5ac52
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd9dbcc0a59475ba77d799f67faeefe4264cbdec6b1a45180bd6104568a5ac52/
Verdict:
Malicious
Threat:
Family.AGENTTESLA
Link:
https://tip.neiki.dev/file/fd9dbcc0a59475ba77d799f67faeefe4264cbdec6b1a45180bd6104568a5ac52
Threat name:
Win32.Trojan.Golsys
Create hunting rule
Status:
Malicious
First seen:
2025-08-25 04:11:13 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
37 of 38 (97.37%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7wo3zqffsr23u56xth3h7lxp4qtezppmnmnekgal2yiek2ffvrja._file
Verdict:
malicious
Label(s):
mofksys
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
error
AgentTesla
Result
Malware family:
mofksys
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:mofksys defense_evasion discovery keylogger persistence spyware stealer trojan worm
Link:
https://tria.ge/reports/250825-hxb2dscp5x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
AutoIT Executable
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Drops startup file
Executes dropped EXE
Boot or Logon Autostart Execution: Active Setup
AgentTesla
Agenttesla family
Detects Mofksys worm
Modifies WinLogon for persistence
Modifies visibility of hidden/system files in Explorer
Mofksys
Mofksys family
Verdict:
Malicious
Tags:
trojan Win.Malware.Swisyn-7610494-0
YARA:
Windows_Generic_Threat_2bb7fbe3
Link:
https://app.threat.zone/submission/e9510e32-0fa9-478e-8cc1-31dc6218303f
Unpacked files
SH256 hash:
fd9dbcc0a59475ba77d799f67faeefe4264cbdec6b1a45180bd6104568a5ac52
MD5 hash:
7fd736963b459959ed27edcc9d852a94
SHA1 hash:
83aadb421ca5c9b9c8d2ecb27f6c37561dc67f9b
Link:
https://www.unpac.me/results/7b1d1fa0-137b-4bc7-8156-7593dedfeb36/
SH256 hash:
b728ed67e46fd66a5563e5fd023bf7d2d8029b853f5b0e8351cf507749617d61
MD5 hash:
ca0f3f2032c902921499ee7a066ca879
SHA1 hash:
6015dcad5ccaf38bad292c996f3011ccfa6f9ab8
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/7b1d1fa0-137b-4bc7-8156-7593dedfeb36/
SH256 hash:
820ea5e31483807350db904a054f1b1f92b2bcbf8eda03321e877c1dc06e562f
MD5 hash:
e78614db11e3496fd454108b9dc5767d
SHA1 hash:
2a1b41dc47f554dbb8a20eb6a5c6a9bfd2365baa
Detections:
win_agent_tesla_g2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
Agenttesla_type2
Create hunting rule
Link:
https://www.unpac.me/results/7b1d1fa0-137b-4bc7-8156-7593dedfeb36/
Parent samples :
ed9bfa1f7f07bff0cc174954b4ce718b7bdce2ee763242dbf8475ed5d39ed4b6
4df8ed5e7b1c5dfe367b89b30645ea500581291013faaf500a4de47c329ab8fa
5d9a0c121c55de87c1950e12fcf124ed935f511080e05a87a72f07ea3d350ef7
1fdcd91233a882bf833a62bca1e4dcf3421caf6fb38096b8f462a67c767a6173
7e36d0b2ba5a6b09423738f12a696379d98d61b64d0ed47a5cf6f1c9603bce3c
820ea5e31483807350db904a054f1b1f92b2bcbf8eda03321e877c1dc06e562f
8174eefb544829f0cccab2f0f4ec4086411987be71b6744c27a4c46f47e5873c
7eee1eb6d127253d4b70049f7c69338287b42dfee47a3b4926e5937fd9bd6250
344cee3534296bfa8f7c3d6a2ec62d91e0c24c36493a6680dc12b3a16a593df2
dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12
2f1a648c2525b3264d4a3fd9efbefdc0e4126a9880d2c127d45a3b1332fe5825
1d3b464b3dc45eebba5783fd28accfb325cdc50f7b165286c0ec9cbd76521774
95d948e77fdb81bdeee51da079e6e6d7625531f9ec9f897a78df51cabf92974a
2137490a7f27e7699edd8eab00facacac1b28677d9eb3aa4d0cf460e53c5a037
3f9664d0797d2b2018493447b69d6f662642c00ec3b652ab1f61b999609baa63
e768e7a34bed579f0de9d9fdb0ca8d2adf8de7d636ab41d7b37eb230906e9787
f4d970fba03932f2d3ebdb87fc65795a646cfeded5dc236d670bd0559944be72
44e5228cfda6b52b192d2cdbce315ff517d43a087fb4bdde35b33ab197244bc6
f82f264ad6f058381f88f1a6a98315553ac229454e95d2da4260dc897c953016
74ca5aad35d138c31e8cc8bf3a0d3389ab321fac99483f475fa434a6ffd8a6a4
1bcb72b88ea1c633b9572258bfb6643c058e1e9454c3c2df61a87dcec3582678
fc5e50499a1fa723718d4b4624f12284ebb555cb577c4beec266b2bce0567b23
56140cf244531d1e238d942285ad7f4590b40bda2f2c80628d4f081345bb19c4
fd9dbcc0a59475ba77d799f67faeefe4264cbdec6b1a45180bd6104568a5ac52
915cd680a2253acc535668333c7147e97683c9a877b8b71c6256591ff42a2997
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fd9dbcc0a594/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fd9dbcc0a59475ba77d799f67faeefe4264cbdec6b1a45180bd6104568a5ac52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:agentesla
Create hunting rule
Author:Michelle Khalil
Description:This rule detects unpacked agenttesla malware samples.
Rule name:AgentTeslaV2
Create hunting rule
Author:ditekshen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:AgentTeslaV5
Create hunting rule
Author:ClaudioWayne
Description:AgentTeslaV5 infostealer payload
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Windows vault credential objects. Observed in infostealers
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:MALWARE_Win_AgentTeslaV2
Create hunting rule
Author:ditekSHen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:ProtectSharewareV11eCompservCMS
Create hunting rule
Author:malware-lu
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_Imphash_Mar23_2
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Reference:Internal Research
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Generic_Threat_2bb7fbe3
Create hunting rule
Author:Elastic Security
Rule name:Windows_Generic_Threat_9f4a80b2
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_AgentTesla_ebf431a8
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe fd9dbcc0a59475ba77d799f67faeefe4264cbdec6b1a45180bd6104568a5ac52

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/23355/

Comments