MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19f8b064a56047ee56ac2ba3d265f83b1b50aa18a228f67de9f0df0afa324c51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19f8b064a56047ee56ac2ba3d265f83b1b50aa18a228f67de9f0df0afa324c51
SHA3-384 hash: 275aa766488c653ac0e455b17431de9e4ca6c9c8c75ef8be89730d90379b0553424ad7d0a7bafad7d3919e9cbff2ad93
SHA1 hash: 2cba653cf531db6198d84c723a43cc105da2479d
MD5 hash: 5dd01c5b6b969960e1956082ee01afea
humanhash: happy-apart-wisconsin-bluebird
File name:5dd01c5b6b969960e1956082ee01afea
Download: download sample
Signature AgentTesla
Create hunting rule
File size:856'576 bytes
First seen:2022-10-06 12:47:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:muEenOFiOkLIm2kLLpLn4SlAr6/2CIxGAffJ8Vl0wLMKkWytg6IPO1mgQo5f/pwX:mjFBkPPpLnSe/2C6b58rbkWagdmFe1i
Threatray 20'338 similar samples on MalwareBazaar
TLSH T1FF051298320175DFC8678EB789D85D24AB30A8375303D30F949312AEA99DAD78F146F7
TrID 61.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.0% (.SCR) Windows screen saver (13101/52/3)
8.8% (.EXE) Win64 Executable (generic) (10523/12/4)
5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon d02f2b3337297b96 (20 x RemcosRAT, 4 x AgentTesla, 1 x NanoCore)
Reporter zbetcheckin
Tags:32 AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
236
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/317308/
Detection(s):
SecuriteInfo.com.Variant.MSILPerseus.238213.12878.2749.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/633ece8378d4acb349f4e67e/reports/a0df223b-09df-420d-93e0-a6c976cba7bf/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4628163b-3d97-48ff-9459-6e7568a5f98d
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1084958
Signature
.NET source code contains very large array initializations
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 717515 Sample: yRO32pqIFF.exe Startdate: 06/10/2022 Architecture: WINDOWS Score: 100 45 Snort IDS alert for network traffic 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 8 other signatures 2->51 6 yRO32pqIFF.exe 3 2->6         started        10 newapp.exe 3 2->10         started        12 newapp.exe 2 2->12         started        process3 file4 27 C:\Users\user\AppData\...\yRO32pqIFF.exe.log, ASCII 6->27 dropped 53 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->53 55 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->55 57 Injects a PE file into a foreign processes 6->57 14 yRO32pqIFF.exe 17 5 6->14         started        59 Multi AV Scanner detection for dropped file 10->59 61 Machine Learning detection for dropped file 10->61 19 newapp.exe 14 2 10->19         started        21 newapp.exe 10->21         started        23 newapp.exe 10->23         started        25 newapp.exe 12->25         started        signatures5 process6 dnsIp7 33 api.telegram.org 149.154.167.220, 443, 49699, 49701 TELEGRAMRU United Kingdom 14->33 29 C:\Users\user\AppData\Roaming\...\newapp.exe, PE32 14->29 dropped 31 C:\Users\user\...\newapp.exe:Zone.Identifier, ASCII 14->31 dropped 35 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->35 37 Tries to steal Mail credentials (via file / registry access) 14->37 39 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->39 41 Tries to harvest and steal ftp login credentials 25->41 43 Tries to harvest and steal browser information (history, passwords, etc) 25->43 file8 signatures9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/19f8b064a56047ee56ac2ba3d265f83b1b50aa18a228f67de9f0df0afa324c51/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-10-06 12:10:57 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dh4lazffmbd64vvmfor5ezpyhmnvbkqyuiupm7pj6dpqv6rsjriq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
08bc14005728c20595219fdc64b26c987b33c23a70a17a69437cee0b9048957e
AgentTesla
5e90024a5b064f542afb1c8f9a341bcaa5c9811c24289805e01258cd323be5aa
AgentTesla
827955ec61948dbbf5ede93b4e2ff9933e6cb31579d9bc5df88e96fd4ce2d034
AgentTesla
8dd2ea100a46b99ad89e7754af2dbd306ce5ec10e214687edd629aa6b7ab4cd6
AgentTesla
97c419445239463daaf12bb767b95cb44c43d4ae6d3320e24e2caa8a910ab2db
AgentTesla
db477691da6e5858fb64ce7aa52f6dd983fdb2e7582a441ee45e6b00572f5fe9
AgentTesla
+ 20'328 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/221006-p1rpkshdd6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5508236836:AAFWgQnjxVK5WcJGJYoL3kmrCQIOg7yCfKI/sendDocument
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/afcdada3-f91a-4d7a-976c-af1ce16b3fba
Unpacked files
SH256 hash:
06da9be5aff15602fd692e16898801ead6943571eab88bbe687f34c759344888
MD5 hash:
9498c26d55dcf7bdd013a57aa134ef84
SHA1 hash:
e63e1d8188f6828f980011160e86d21ab040b580
Link:
https://www.unpac.me/results/223c5b5c-58ff-4c8c-bf0d-a6d99b9e10b6/
SH256 hash:
8b33ba8f7b882271d5af035385af7910004419bf1e153646748641840e40585e
MD5 hash:
48d310709d2e626950437140353cb98c
SHA1 hash:
ae943826a94b0a47ecf82f43acf820ad0d965da3
Link:
https://www.unpac.me/results/223c5b5c-58ff-4c8c-bf0d-a6d99b9e10b6/
SH256 hash:
85064641e83c24074aa08f261eeb033bf57f3f03da2d8d0724d5012afebdee0f
MD5 hash:
a2f64a36d737eaa229c285394f3fe479
SHA1 hash:
919b97cecd1c79304ae336a4102d2aa8f72768ee
Link:
https://www.unpac.me/results/223c5b5c-58ff-4c8c-bf0d-a6d99b9e10b6/
SH256 hash:
29c7914bbdf456afb5f0e232fc1b054db64d0f9032a5455ac3007b17ea0ac14d
MD5 hash:
9081c198ac9d033802984b28087c7c7e
SHA1 hash:
8f69c52a600a70438c84be7e0c664e8d9be2f7f4
Link:
https://www.unpac.me/results/223c5b5c-58ff-4c8c-bf0d-a6d99b9e10b6/
SH256 hash:
19f8b064a56047ee56ac2ba3d265f83b1b50aa18a228f67de9f0df0afa324c51
MD5 hash:
5dd01c5b6b969960e1956082ee01afea
SHA1 hash:
2cba653cf531db6198d84c723a43cc105da2479d
Link:
https://www.unpac.me/results/223c5b5c-58ff-4c8c-bf0d-a6d99b9e10b6/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/19f8b064a560/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/19f8b064a56047ee56ac2ba3d265f83b1b50aa18a228f67de9f0df0afa324c51

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 19f8b064a56047ee56ac2ba3d265f83b1b50aa18a228f67de9f0df0afa324c51

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2352950/
Cape
Cape
https://www.capesandbox.com/analysis/317308/

Comments


Avatar
zbet commented on 2022-10-06 12:48:00 UTC

url : hxxp://85.31.46.80/JJB.exe