MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2204721fb0f43f4a2b68a990ac7486515729270a573070155b47fbdac95c3183. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2204721fb0f43f4a2b68a990ac7486515729270a573070155b47fbdac95c3183
SHA3-384 hash: 80e5089b46b9f90ba3bdf9df8b280027c2b1344d3fc277008cc3fa368c7e3da8279eab516c41f5249f6e50df6eaddcba
SHA1 hash: 03e01dc654f5ffdbad47284d38541e69ac7772e2
MD5 hash: 4a8c5e1c5e53e49d81ca4f305d267516
humanhash: lion-lake-fruit-bravo
File name:Mermaid Maritime Public Co., Limited - products list.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'066'496 bytes
First seen:2021-09-13 04:55:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:C/gecNU2zqX6lUB2Akeo2jPU6/gArr7wORMKvZkBYRivuTX/FTO9pe03kF6Bqgrg:/DNgWUB2Akeo2jPU6NPBvZUUX/FIQWh
Threatray 10'116 similar samples on MalwareBazaar
TLSH T1AF357D0177E89624EAEE2730E430CA6507B2FC5AA579D74D18C5BDAB2EB7B814C10773
dhash icon d4d4dad6d6dcc4e4 (34 x AgentTesla, 8 x Formbook, 7 x SnakeKeylogger)
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Mermaid Maritime Public Co., Limited - products list.exe
Verdict:
Malicious activity
Analysis date:
2021-09-13 04:55:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/019d5d21-72c3-4dae-8504-b65f7efebd62

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/187185/
Detection(s):
SecuriteInfo.com.Trojan.MSIL.Kryptik.02cf54f2.10417.1007.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
monero obfuscated packed
Link:
https://www.filescan.io/uploads/6174f9a99a5a1e91c5d1f66f/reports/8fd73b92-2438-44fd-996d-81e0c8cd1978/overview
Malware family:
Quasar RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/beb0e631-9822-41a5-846b-0902d0eb5f41
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/849465
Signature
.NET source code contains very large array initializations
Creates an undocumented autostart registry key
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 481896 Sample: Mermaid Maritime Public Co.... Startdate: 13/09/2021 Architecture: WINDOWS Score: 100 41 youtube-ui.l.google.com 2->41 43 www.youtube.com 2->43 45 www.google.com 2->45 47 Found malware configuration 2->47 49 Multi AV Scanner detection for dropped file 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 8 other signatures 2->53 9 Mermaid Maritime Public Co., Limited - products list.exe 3 9 2->9         started        signatures3 process4 file5 27 C:\Users\user\AppData\...\ettpsong.exe, PE32 9->27 dropped 29 Mermaid Maritime P...- products list.exe, PE32 9->29 dropped 31 C:\Users\...\ettpsong.exe:Zone.Identifier, ASCII 9->31 dropped 33 3 other malicious files 9->33 dropped 55 Creates an undocumented autostart registry key 9->55 57 Writes to foreign memory regions 9->57 59 Injects a PE file into a foreign processes 9->59 13 wscript.exe 1 9->13         started        16 powershell.exe 20 9->16         started        19 Mermaid Maritime Public Co., Limited - products list.exe 2 9->19         started        signatures6 process7 dnsIp8 61 Wscript starts Powershell (via cmd or directly) 13->61 21 powershell.exe 24 13->21         started        35 youtube-ui.l.google.com 16->35 37 www.youtube.com 16->37 39 www.google.com 16->39 23 conhost.exe 16->23         started        signatures9 process10 process11 25 conhost.exe 21->25         started       
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2204721fb0f43f4a2b68a990ac7486515729270a573070155b47fbdac95c3183/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-13 04:56:11 UTC
AV detection:
12 of 45 (26.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eicheh5q6q7uuk3ivgiky5egkflssjykk4yhafk3i755vsk4ggbq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
06b04e6a349914e395b248b9c4d9cfaf028909c0871e3e78f8b6367f36f9eafd
AgentTesla
121aedf2e05496fa5802da72a939a4bb3d2501efa9a8a9be95e98773f93f34c2
AgentTesla
542200906b6fd1d7cbf92964d984d66eb7566451cb68851ab9ddd8761fe68def
AgentTesla
8b4a5801c16f94c66a10ce7a538ca32311b40b465176759fa9c4457092258956
AgentTesla
ae6afd41f48899b7093e7adce00362ad342b1a23495fe1a9e2cb3155b7f3bac4
AgentTesla
b85e4c358cd20b0ad6e0bcdb93e578ee2dc2a898cfa60da1f39be1ea8424ce92
AgentTesla
c771be7912e20d4522cdcfed63feac0e59a91dc053ff96faf862be6a8f8dfa1b
AgentTesla
c9af30b2a800c774844eee76e019d10b72c4637adbccd34a6de3bcc8a4f32ba4
AgentTesla
cac3ab8433e775a539ed661fb2d9caf7799213007b9f8bc01080557c452ccc41
AgentTesla
f9af6e0e93f066a5788d1c5d0014204ff29c0080727647857e8f604885e552d8
AgentTesla
+ 10'106 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210913-fkpevacgh9/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
f50a51ba33c74a7c0c5526aa9da858020c4076651688e48dec7e3bf843133673
MD5 hash:
ee691e9c11549fa947f8c13acb2abeec
SHA1 hash:
98be76a7c609de13e41a6bf74f98dbe40a0b97b9
Link:
https://www.unpac.me/results/58acfc01-3702-46b0-a5c9-b8f69eb5792b/
SH256 hash:
6e8f005899844e563387a8d031eddc959e227d733af8d2cd47056047c3078946
MD5 hash:
74a2095ce78a61391b6e1058170ddf9a
SHA1 hash:
9659c71e31ab2884ee5ecc0deb6a6d02774c1171
Link:
https://www.unpac.me/results/58acfc01-3702-46b0-a5c9-b8f69eb5792b/
SH256 hash:
bec1789862dcbd8cc4e20d018d40ac90f7a467827c42c8defafc71444bf61258
MD5 hash:
bae5ac060b3426802fd3a4d36ecff504
SHA1 hash:
30834f809acd5d88a6d378bfe3aa75473c5d0475
Link:
https://www.unpac.me/results/58acfc01-3702-46b0-a5c9-b8f69eb5792b/
SH256 hash:
2204721fb0f43f4a2b68a990ac7486515729270a573070155b47fbdac95c3183
MD5 hash:
4a8c5e1c5e53e49d81ca4f305d267516
SHA1 hash:
03e01dc654f5ffdbad47284d38541e69ac7772e2
Detections:
win_karkoff_auto
Create hunting rule
Link:
https://www.unpac.me/results/58acfc01-3702-46b0-a5c9-b8f69eb5792b/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/2204721fb0f4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2204721fb0f43f4a2b68a990ac7486515729270a573070155b47fbdac95c3183

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_karkoff_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 2204721fb0f43f4a2b68a990ac7486515729270a573070155b47fbdac95c3183

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/187185/

Comments