MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e856ebbcc8bbbc799372a89e500d0d13450423481c65a0b0559666f6a38dd42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e856ebbcc8bbbc799372a89e500d0d13450423481c65a0b0559666f6a38dd42
SHA3-384 hash: 8cb62ef5545294b34018fd0e71ed83c456fb46373e1a84660865072618c5632fa2776deb70093e9d593acd55d2f72f8b
SHA1 hash: 4fe30e12887025cf39dbbd53025ebbc187b7c780
MD5 hash: 37f317fa15efe727f89ad47f18938ed9
humanhash: lake-utah-alpha-neptune
File name:37f317fa15efe727f89ad47f18938ed9
Download: download sample
Signature AgentTesla
Create hunting rule
File size:739'328 bytes
First seen:2021-09-30 15:56:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:GbYbQ+X8+UiDLbRHahUUiTnfVpxOVyIKOT9gynhYh71JzkY63AP+b:zbQ+X8+UiDLbRHahUUWnfVrOVyIFpazq
Threatray 10'551 similar samples on MalwareBazaar
TLSH T12BF48D14F11CD2B9FE0922B1263DFCC825F82EA9147DF91BB9D7B1A224B9E7154B0097
Reporter zbetcheckin
Tags:32 AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
180
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
37f317fa15efe727f89ad47f18938ed9
Verdict:
Malicious activity
Analysis date:
2021-09-30 21:00:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/136b47a7-cb2a-47aa-bfe2-d2c8e54113f2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/193734/
Detection(s):
SecuriteInfo.com.Variant.Fonctuzim.1.13267.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6f4c53ab-61ae-419f-85bd-ba3145252fb5
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/862063
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 494491 Sample: lN5ZCkrdLX Startdate: 30/09/2021 Architecture: WINDOWS Score: 100 43 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->43 45 Found malware configuration 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 5 other signatures 2->49 6 lN5ZCkrdLX.exe 3 2->6         started        10 pGKuRU.exe 3 2->10         started        12 pGKuRU.exe 2 2->12         started        process3 file4 25 C:\Users\user\AppData\...\lN5ZCkrdLX.exe.log, ASCII 6->25 dropped 51 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->51 53 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->53 55 Injects a PE file into a foreign processes 6->55 14 lN5ZCkrdLX.exe 2 5 6->14         started        57 Multi AV Scanner detection for dropped file 10->57 19 pGKuRU.exe 2 10->19         started        21 pGKuRU.exe 2 12->21         started        23 pGKuRU.exe 12->23         started        signatures5 process6 dnsIp7 31 alphaforge.net.my 110.4.45.194, 49811, 587 EXABYTES-AS-APExaBytesNetworkSdnBhdMY Malaysia 14->31 33 mail.alphaforge.net.my 14->33 27 C:\Users\user\AppData\Roaming\...\pGKuRU.exe, PE32 14->27 dropped 29 C:\Users\user\...\pGKuRU.exe:Zone.Identifier, ASCII 14->29 dropped 35 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->35 37 Tries to steal Mail credentials (via file access) 14->37 39 Tries to harvest and steal ftp login credentials 14->39 41 2 other signatures 14->41 file8 signatures9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1e856ebbcc8bbbc799372a89e500d0d13450423481c65a0b0559666f6a38dd42/
Threat name:
ByteCode-MSIL.Infostealer.DarkStealer
Create hunting rule
Status:
Malicious
First seen:
2021-09-30 12:39:28 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d2cw5o6mro54pgjxfke6kagq2e2faqruqhdfucyflftg62ry3vba._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0aee4e28fcaa8811684d3fac7e05d62276530b2ca506554132b82cb741de743b
AgentTesla
45fcc59bfbef8829e6261a4dbdc690c2ee1bc3de116fba86a7312a69b48bcf26
AgentTesla
83cba7d0953f13023b1e12c0c32cf02ac35f9fedff3546f0112635cc5a5d9d66
AgentTesla
963879f70de719fb2f4d68b14fa181f0fe72fca3856a9e154081fb0759dd19b3
AgentTesla
aa2d49da658b183554ad762c05a63fec2be80c749c4148dfc136325fb689c995
AgentTesla
bc730cbb516c41290fc555735c26b2a2dc0d8aaeba9bd49a0db33ec0e0c8c1fd
AgentTesla
c8a439c351e234cd57b8bba06cafeaf663323ffd53107f60657837dc2406cb1c
AgentTesla
+ 10'541 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210930-tdya3aabfp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
f35304a2fc54b2306005ede6a2555645bae9fd8966e5727a11cf827d0e8db6e3
MD5 hash:
fe07a3b1b3dccb0cc19a90c8ba247cac
SHA1 hash:
ef1b4439730b5721587f49696af72fdd55a14d5f
Link:
https://www.unpac.me/results/d55a14e3-a0a5-4839-a0b0-340995b01c17/
SH256 hash:
4f9be20f7af1f003bc6b08a2c27bf9abcd64cb80c5dd93f67cbfe2beef8b86dd
MD5 hash:
fb743217348428f9b2215d640e86a1d6
SHA1 hash:
8e15398da0857d4b34490993eab07dba5b2691d7
Link:
https://www.unpac.me/results/d55a14e3-a0a5-4839-a0b0-340995b01c17/
SH256 hash:
568d03e90c0d0569ce1ef854b92376434ed158a0d0ef39b677a23f6daa268b11
MD5 hash:
fc11bd9d16a8d7fa0734e8621b41ba7c
SHA1 hash:
4b6794b0776516050c3a92877d7ea4ab0b8a0808
Link:
https://www.unpac.me/results/d55a14e3-a0a5-4839-a0b0-340995b01c17/
SH256 hash:
6fef8420a8bd6a90cfe7ac8aeb0e3811422b9b6cb9e0b14ea03f5236438f72ba
MD5 hash:
10c7772f435231d58046e0dc34def127
SHA1 hash:
38c8f9ffb5136848d62582ef41bab6c810121c74
Link:
https://www.unpac.me/results/d55a14e3-a0a5-4839-a0b0-340995b01c17/
SH256 hash:
f7d272daf3522f99ca67b99bfe557564baba239104c7f20cef842f2e870bdf28
MD5 hash:
cceaca53d81061c0f1c6cf35ca7bf34b
SHA1 hash:
23ba45b249e0e4bdc5a8d4b4b07e2f7509cf85be
Link:
https://www.unpac.me/results/d55a14e3-a0a5-4839-a0b0-340995b01c17/
SH256 hash:
1e856ebbcc8bbbc799372a89e500d0d13450423481c65a0b0559666f6a38dd42
MD5 hash:
37f317fa15efe727f89ad47f18938ed9
SHA1 hash:
4fe30e12887025cf39dbbd53025ebbc187b7c780
Link:
https://www.unpac.me/results/d55a14e3-a0a5-4839-a0b0-340995b01c17/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/1e856ebbcc8b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/1e856ebbcc8bbbc799372a89e500d0d13450423481c65a0b0559666f6a38dd42

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 1e856ebbcc8bbbc799372a89e500d0d13450423481c65a0b0559666f6a38dd42

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1649286/
Cape
Cape
https://www.capesandbox.com/analysis/193734/

Comments


Avatar
zbet commented on 2021-09-30 15:56:15 UTC

url : hxxp://lg-tv.tk/kellyzx.exe