MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06cb801cdd6a42783ad3d7de6bd9928b53d714015611c28edc9fb7eb955f53c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06cb801cdd6a42783ad3d7de6bd9928b53d714015611c28edc9fb7eb955f53c9
SHA3-384 hash: 1d99a38fb2431043c56fff3e42803f71b718c2a5d2d4e10529d648355083274c8faa303b96f0406a246dabe154b0068e
SHA1 hash: bd9b1076defa689e0f159412cb9687b7db57a0fc
MD5 hash: 195ff766a198591eaefd9507794d1acc
humanhash: tennis-football-nevada-freddie
File name:RFQ 6000000757 - 14000461.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'011'712 bytes
First seen:2023-04-11 06:55:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:G1QhklU0YNOCaOogX0TZNrb7/PuPczT9Q:Ge0YNOCaOz0TZZbzGPkT9
Threatray 1'960 similar samples on MalwareBazaar
TLSH T1D225AEC46AC54BD0C037F175B04BCAB3C7D2092AE089DAF13897668694D2E525DF68EF
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
271
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ 6000000757 - 14000461.exe
Verdict:
Malicious activity
Analysis date:
2023-04-11 06:58:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/512af62a-39c2-4fbd-a84d-8b96e2d8ba86

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/381345/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/643504840dbc8763b8a107da/reports/09098ffb-4cd0-482f-9c00-8d414e012e88/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/06cb801cdd6a42783ad3d7de6bd9928b53d714015611c28edc9fb7eb955f53c9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b7bfe5d6-a497-4aff-b6f9-660468ebe9ef
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1211514
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/06cb801cdd6a42783ad3d7de6bd9928b53d714015611c28edc9fb7eb955f53c9/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-04-07 20:24:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a3fyahg5njbhqowt27pgxwmsrnj5ofabkyi4fdw4t636xfk7kpeq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1249d019671494f72d4c416ce9b7cf6523ac63eca06dad4da4eaf936d3e36888
AgentTesla
2830200c6f723cc10db5cf9a9cbfa43a36d2709cc4150b6ebae51573eb68115a
AgentTesla
29efaf03dee08b4e3f4e23e41b9581513da070dc49e746e91aee2022fef12088
AgentTesla
37af30e0d821d7a867487bcddda594c477b1bf7761f0369011eccaa450874667
AgentTesla
3f7e041e466f779ea61696d2b932da57ce525fefe11972c8a7a489b1a2a9e38e
AgentTesla
546296386f790b239e38e70b371954f4ca87d4715bc3147497f82c466d721ce2
AgentTesla
65bcc5465b882fffc22d29b8676d43bf7b6e2d9d30a61bf4b1dc8b0483f1b0f6
AgentTesla
a8c3da8603f25f41857ee7ccde840828c700867c91f49e7e16dce2a0fdd1ffaf
AgentTesla
b8240784dc76e0d06183f6e4518b2a4aa24a7cbe28f275e13ffa35b26d7df343
AgentTesla
d9714cc1bedd6d2bc845fe08c8328c5f3d20fd4280339e8135309fa3e7958b95
AgentTesla
+ 1'950 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230411-hqcdkscf4w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot6150028123:AAEEd2A6XOEJtW6RYKc7tExhq48wfha9Eug/
Unpacked files
SH256 hash:
d30304173bb9a15147df07aed00b7a4db0f4e8f07e4b26213860f6cca2701eb3
MD5 hash:
afbfad9777cfa2be67227f25505df155
SHA1 hash:
ef2adca5cbb57c2ce66a44ebc5b693b7c95c9737
Link:
https://www.unpac.me/results/c80a1e39-7eb8-43a5-ab1d-c3fab59dadc7/
SH256 hash:
fd5af075120ab71d92b70e0041742bd68f62a50606ff8e8c89767a059c41a414
MD5 hash:
8a5f25a9fbb5d0b8337f7e44fb77dd22
SHA1 hash:
8bb7ef2145fe5d3b8cf4f3abe5da9a6af4b675a7
Link:
https://www.unpac.me/results/c80a1e39-7eb8-43a5-ab1d-c3fab59dadc7/
SH256 hash:
042d61ed5c3c63e8ce879cfb51c7b8b3a573ce4602009abad4365d661761249a
MD5 hash:
e2a779db9606bc661345936df4e3cdee
SHA1 hash:
7970ab0ba3888001833b3f80eb1c1e0660567967
Link:
https://www.unpac.me/results/c80a1e39-7eb8-43a5-ab1d-c3fab59dadc7/
SH256 hash:
3c507afadbb1c31a9ebdd24baac5739d47576159e01c5e84f973c951885100aa
MD5 hash:
e79bf0e7e9d52d398e0b23b352394c68
SHA1 hash:
682325763a0ec77e0fd475ea3a4021b4651eceac
Link:
https://www.unpac.me/results/c80a1e39-7eb8-43a5-ab1d-c3fab59dadc7/
SH256 hash:
ae09f69ae1f8064255a4cc374070d4a882a3abba00639ee1c206eed3f2982e98
MD5 hash:
c75f4fc5f57dcfda371b334c7baa78b0
SHA1 hash:
608bea0ef153549552916b3089ac2b7334b07464
Link:
https://www.unpac.me/results/c80a1e39-7eb8-43a5-ab1d-c3fab59dadc7/
SH256 hash:
06cb801cdd6a42783ad3d7de6bd9928b53d714015611c28edc9fb7eb955f53c9
MD5 hash:
195ff766a198591eaefd9507794d1acc
SHA1 hash:
bd9b1076defa689e0f159412cb9687b7db57a0fc
Link:
https://www.unpac.me/results/c80a1e39-7eb8-43a5-ab1d-c3fab59dadc7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/06cb801cdd6a42783ad3d7de6bd9928b53d714015611c28edc9fb7eb955f53c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 06cb801cdd6a42783ad3d7de6bd9928b53d714015611c28edc9fb7eb955f53c9

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/381345/

Comments