MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff2be6f85c26c62d50364e48cc6f6209df35b82d6c4b0db31e776f84b81629a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 16

Intelligence 16 IOCs YARA 4 File information Comments

SHA256 hash:	ff2be6f85c26c62d50364e48cc6f6209df35b82d6c4b0db31e776f84b81629a5
SHA3-384 hash:	3dd03719fabb550c1f12738c34b47581223b71cc1a8fdffaaf95a281dbfb5b893a7c9ba9c9a45f77c42194e86acdb9a8
SHA1 hash:	5923e89201e0d9a5dd35763eb2c8a0ade982dcb4
MD5 hash:	c6fe897cf4e5f9cd403bcde5a721c381
humanhash:	hawaii-oscar-undress-nuts
File name:	Comprobante_98756.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'064'448 bytes
First seen:	2024-09-19 12:27:20 UTC
Last seen:	2024-09-19 12:28:46 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep	24576:ftb20pkaCqT5TBWgNQ7aRxt9sqvOXiA6A:cVg5tQ7aRxt9cv5
Threatray	1'501 similar samples on MalwareBazaar
TLSH	T1DA35BF2273DDC361C3725273BA25B701BEBF782506A5F96B2FD4093DE920162521EA73
TrID	68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 12.5% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
File icon (PE):
dhash icon	aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter	adrian__luca
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

369

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

Re_ Comprobante de pago.eml

Verdict:

Malicious activity

Analysis date:

2024-09-12 19:41:34 UTC

Tags:

evasion stealer agenttesla ftp exfiltration

Link:

https://app.any.run/tasks/8ac24b37-8def-4a5b-9112-d902f4367f2e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66ec18df4ec6bdebe530453f

Tags:

Generickd

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

autoit fingerprint infostealer keylogger lolbin microsoft_visual_cc packed shell32

Link:

https://www.filescan.io/uploads/66ec18d9ede3a801b07ed676/reports/fafef2b0-7e81-4114-8a08-4c8cb440848d/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/ff2be6f85c26c62d50364e48cc6f6209df35b82d6c4b0db31e776f84b81629a5

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/23f39e2d-7963-4664-bc99-1f8e0bc31a08

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1513860

Signature

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ff2be6f85c26c62d50364e48cc6f6209df35b82d6c4b0db31e776f84b81629a5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ff2be6f85c26c62d50364e48cc6f6209df35b82d6c4b0db31e776f84b81629a5/

Threat name:

Win32.Trojan.Tempedreve

Status:

Malicious

First seen:

2024-09-12 19:11:04 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=74v6n6c4e3dc2ubwjzemy33cbhptlobnnrfq3my6o5xyjoawfgsq._file

Verdict:

malicious

Label(s):

autoit

AgentTesla

a745120f8c630fc43742d0127740278ea80a9f397833f2aef584d20924588191

AgentTesla

b143b4d29760b4f5638c22da61dda177577b02bf4d65efd78f8ba73e2ebc683c

AgentTesla

bc6e6e8424ee949c7c08cd6185031cc1c692290fed0fa767ead6c868fffa770d

AgentTesla

ce89a0a88051c50bf0be5ab41e5f2d478b5f3eac141b37a9743cab99423656ce

AgentTesla

dfca1291bcdc6fd3a0a7ae07cc153d3fc07c418138b1d2896f818d9ac3252a7c

AgentTesla

ed9bfa1f7f07bff0cc174954b4ce718b7bdce2ee763242dbf8475ed5d39ed4b6

AgentTesla

+ 1'491 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla credential_access discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/240919-pnb4csyaqh/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Looks up external IP address via web service

Credentials from Password Stores: Credentials from Web Browsers

AgentTesla

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/cb8c6037-1b8a-43d0-bb16-e757494dfd22

Unpacked files

SH256 hash:

213215574964beac6055f2cd9e7935b9394ce1aab54d0a723682700dbbac21fe

MD5 hash:

6001b9d313616cf68a9d9d6bc7492015

SHA1 hash:

6aec558ebca79b3a6a0b4aaf3c9daa18a1fe7cf5

Detections:

win_agent_tesla_g2

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Agenttesla_type2

MALWARE_Win_AgentTeslaV2

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Link:

https://www.unpac.me/results/4f28b6da-3b50-49f1-acf8-a68258726d66/

Parent samples :

c9be1ff9d80d934774556669459ad3242500a745531ba25f7c874f32f318cdd1
f08afadff8298941a488a237df4deb8f94f13bf274411548f386d2828f4df636
51f24503d32c9e10a2e7afe027d438380d007cd1566e5399cc52b039cacdb2ea
bc3e963b1e6f8e375e6814f653eeb463d2bf8e47b867cf16ca9964a5e0d43804
ce89a0a88051c50bf0be5ab41e5f2d478b5f3eac141b37a9743cab99423656ce
c8634453c065450c28be1e99497aea78c294693e0c05e63a6d6fb83cc621f190
71f5ee1f2818fe32525676a403776d620101dfe96ae3873a3e325016ff136002
48d245036c30302a860c3a616e29cb0e633fca178bb363d01007432d3c571713
64786f8c089130fa81ba1970f8bcdee574964bb7653f5aca740a38fc6eef74e2
aa64d8ae63a060c83638ad8a45e5a4e445a53845f4f22fe808f1828663629731
7f8bb8901ac2cd42c191b43dc859d256628e6419a418feed9bf44210b1e4c207
213215574964beac6055f2cd9e7935b9394ce1aab54d0a723682700dbbac21fe
e46caf67893b64806cdcea05d9b42e52fa65f239cc12782ab31766beac12eb37
2fdefe874a54576e8a4f4566b328120a7163a47b1000af443683af41698b6b2a
717b2beba07031c0671b2cb794d01b5f365c58ab156c0929a05d1cc0f3f4b17e
274013bc54c33bfd77473b8a92016b247b6832a1d26a9f412596cc9189775efe
2ddbd1c388f18a820122163f5c250dbfac936824267487cf0c81fb3b01185b4a
cdd388be236deee1d6613f35f895fa3adc65cd680e560faf0a174b0004c93995
967e07ed35fc477b00fe777c8bd4f5e7ead02d2581987bb75f6386a485799078
2b8f5dfdd98be0d5612f31c49ec4e3abdc14ab16091582f904949a1bdf476ab4
b96a282048c3221ce0180359da5cf97c55c7cfb054f7cfdde1bf5438fdb55399
d8190f8804e6bb5885f42a27307794ceae1fd1d4675b3c6a96d70c30324374bb
44cf26d4eda3a4366204a89842a433c77e44184db6bf2c00a3547288a73d4792
213255cb36f1a19a7d374ba37f98b553f2a10fa9f486e92ed2ca377d1a6dc6d7
4b76f920a96119a383e7c5df2992e9e7fe5e11ef45e1a630dbe8b3abc49abae7
3661575ad4a227bc52a9fcdb9a56ea19e0f882105300b938e9c0b634fe46d892
ebf39fb8c6da07c6f344537cb98113d3f6f34bac9097e2c195bb9073c790d1c5
14825e0e8ecc953c8ddf82dc0af6159ec59d97ea51472a3a025f0a7c2afef1ad
e7a1f2a77a5d8a28ca36421484bb560f334b4399ae93ebdba719486788edd854
4eae876a9c21fadb647a6fe14c83272189ace267ebed4b320c73da14e095dec7
34e8ac3bd8264bf5915c4bdbd7317bd369a1c60548f3bf18ddb12f0780593208
ff2be6f85c26c62d50364e48cc6f6209df35b82d6c4b0db31e776f84b81629a5
86c0e8c71fe53ff1ee1ac2a494c208392b9f4128f85552e69105e8fa19724f63
50eae2b11320442a2ac89762a8bac816626850ac2563312a9b421d692fdd8ac2
0eee8e3b1a6558f648e2519e494ea36b8e079bf6e0cbba55bfa9dcbfc99eac11
fc7c241bd2d7edf961b8f1af19fc80419d239c67d72a8eb0610152f1e67841d1
7c11ccc1701800c57b435767bc27bf966b88c66e0df0dd220d9f3e6bde634367
93a9b3b4455c1e8469d1e70599f1ba12d103dbf09d9bcaf079a00e0ca55aa72c
1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af
f8b68f9f0dc3d844e3ae080463b29bc9bb82a750b3ab01aed7fcab4cef1519a8
67bf2a6e18cc9f982fbafc235f75604ab53da2936365bb29dc008470ebfb7fd1
92c5d005c4454ff4be8093157b6f5d5cb11e7254fb3f979ffdddf167e464955f
78d2fb60645775efc2137c4f4dab8f737724f9936577f84fe3e3e01622e9770b
523c3e9f716ca9f2a75109f674135b55e9b25259d5d078175fb5580965426f8a
d2b275edfe93caf7e90362a513f00ffec34f1b10df49d950db008a3417045311

SH256 hash:

ff2be6f85c26c62d50364e48cc6f6209df35b82d6c4b0db31e776f84b81629a5

MD5 hash:

c6fe897cf4e5f9cd403bcde5a721c381

SHA1 hash:

5923e89201e0d9a5dd35763eb2c8a0ade982dcb4

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/4f28b6da-3b50-49f1-acf8-a68258726d66/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ff2be6f85c26c62d50364e48cc6f6209df35b82d6c4b0db31e776f84b81629a5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	YahLover Create hunting rule
Author:	Kevin Falcoz
Description:	YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

exe ff2be6f85c26c62d50364e48cc6f6209df35b82d6c4b0db31e776f84b81629a5

(this sample)

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::AllocateAndInitializeSid ADVAPI32.dll::CopySid ADVAPI32.dll::FreeSid ADVAPI32.dll::GetLengthSid ADVAPI32.dll::GetTokenInformation ADVAPI32.dll::GetAce
COM_BASE_API	Can Download & Execute components	ole32.dll::CLSIDFromProgID ole32.dll::CoCreateInstance ole32.dll::CoCreateInstanceEx ole32.dll::CoInitializeSecurity ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::mciSendStringW WINMM.dll::timeGetTime WINMM.dll::waveOutSetVolume
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAce ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::CheckTokenMembership ADVAPI32.dll::DuplicateTokenEx ADVAPI32.dll::GetAclInformation ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExW SHELL32.dll::ShellExecuteW SHELL32.dll::SHFileOperationW
WIN32_PROCESS_API	Can Create Process and Threads	ADVAPI32.dll::CreateProcessAsUserW KERNEL32.dll::CreateProcessW ADVAPI32.dll::CreateProcessWithLogonW KERNEL32.dll::OpenProcess ADVAPI32.dll::OpenProcessToken ADVAPI32.dll::OpenThreadToken
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::SetSystemPowerState KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW IPHLPAPI.DLL::IcmpCreateFile KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameW ADVAPI32.dll::GetUserNameW ADVAPI32.dll::LogonUserW ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_API	Supports Windows Networking	MPR.dll::WNetAddConnection2W MPR.dll::WNetUseConnectionW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegConnectRegistryW ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::BlockInput USER32.dll::CloseDesktop USER32.dll::CreateMenu USER32.dll::EmptyClipboard USER32.dll::FindWindowExW USER32.dll::FindWindowW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample