MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ba931f3d786284d056bd83659afabe498c61c999fd5d64837da8c2b737e3746. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ba931f3d786284d056bd83659afabe498c61c999fd5d64837da8c2b737e3746
SHA3-384 hash: a0c794a6f1cbe2b8f3475902ebce629e4a6915d88df4143abccd47c4db1f7f8136f4bb2dce3a13b688c61077074bf311
SHA1 hash: c2da68d0338eef8506288d2c706518635153a9d6
MD5 hash: 36f8ef6bb5f1eb0e31788497a53277f1
humanhash: fillet-echo-avocado-early
File name:Commercial Invoice PL#1009 - Urgent,pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:823'296 bytes
First seen:2023-07-26 06:30:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c4867fc7f459baf2209064e6b84b9cd0 (1 x AgentTesla)
ssdeep 12288:AsgeyDZ++kHOFSOYloGEa7IlS9yfZnwABjXjibbS5GdxWgy9cAjG4:xgrbkuFSOYlo1a7IcWZnwOKbbMjcAj
TLSH T15D05AE34A2B890B3E11A6A358D4AE75848247D303D34A4BB6AFB7DDCDA7B243F4151D3
TrID 36.1% (.SCR) Windows screen saver (13097/50/3)
29.0% (.EXE) Win64 Executable (generic) (10523/12/4)
12.4% (.EXE) Win32 Executable (generic) (4505/5/1)
5.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
5.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 809cf0d2d4c2d400 (7 x ModiLoader, 1 x AgentTesla)
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla C2:
http://chibb.ydns.eu/chibbori/inc/8fcde15698ce9a.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
301
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
Commercial Invoice PL#1009 - Urgent,pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-07-26 06:32:10 UTC
Tags:
dbatloader stealer agenttesla
Link:
https://app.any.run/tasks/a176bcfb-7bd9-4dfb-9374-b205e3eda13d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/433357/
Detection(s):
Win.Trojan.Sinowal-9756760-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Launching a process
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/1ba931f3d786284d056bd83659afabe498c61c999fd5d64837da8c2b737e3746
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Dbatloader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1d58f851-8ab9-4f58-8134-721f10f2c6df
Result
Threat name:
AgentTesla, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1279846
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ba931f3d786284d056bd83659afabe498c61c999fd5d64837da8c2b737e3746/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-07-26 06:31:05 UTC
File Type:
PE (Exe)
Extracted files:
45
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=doutd46xqyue2bll3a3ftl5l4smmmhezt7k5msbx3kgcw436g5da._file
Verdict:
malicious
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader trojan
Link:
https://tria.ge/reports/230726-g92l5saa8t/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
ModiLoader Second Stage
ModiLoader, DBatLoader
Unpacked files
SH256 hash:
6ac684a719b294991da92b688411444e51e16bbbc79078cf999b4e9517a3d5cd
MD5 hash:
c0ebbf79a62452d160b324d71c2d66d7
SHA1 hash:
60c98b6230cdd92b2d7430063b3dd7c133de515d
Detections:
win_dbatloader_g1
Create hunting rule
Link:
https://www.unpac.me/results/430e80e1-a71e-4071-8efa-4f67fe8af830/
SH256 hash:
1ba931f3d786284d056bd83659afabe498c61c999fd5d64837da8c2b737e3746
MD5 hash:
36f8ef6bb5f1eb0e31788497a53277f1
SHA1 hash:
c2da68d0338eef8506288d2c706518635153a9d6
Detections:
DbatLoaderStage1
Create hunting rule
Link:
https://www.unpac.me/results/430e80e1-a71e-4071-8efa-4f67fe8af830/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1ba931f3d786/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.53
Link:
https://yomi.yoroi.company/submissions/1ba931f3d786284d056bd83659afabe498c61c999fd5d64837da8c2b737e3746

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CMD_Ping_Localhost
Create hunting rule
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Typical_Malware_String_Transforms
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research
Rule name:Typical_Malware_String_Transforms_RID3473
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/433357/

Comments