MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a
SHA3-384 hash: 933ea3e4a7368363a68e78d44917c59b9987d272eb6e38bf78d93bb3506cc6c1fe9f8933be4b8b07c8a1dd26c68b4c00
SHA1 hash: b168bb726e9ec94166e60cc3d502843058ede5a4
MD5 hash: 2c520c9db37e16343941bbba36fc22ef
humanhash: early-alanine-cold-fix
File name:x.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:888'787 bytes
First seen:2024-03-28 09:12:52 UTC
Last seen:2024-03-28 11:24:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 890e522b31701e079a367b89393329e6 (25 x Formbook, 12 x AgentTesla, 8 x Loda)
ssdeep 12288:Z6Wq4aaE6KwyF5L0Y2D1PqL/2p7v95HcYuHfWpKbyiJZUHKA4b5:vthEVaPqLOp7v954uMbyiJWHKAK5
TLSH T172152A9BB599523AE5C9EBF2E3679CF39D6432FB593602385D1C2E803B0D70D4B52224
TrID 86.7% (.EXE) AutoIt3 compiled script executable (510622/80/67)
4.5% (.EXE) UPX compressed Win32 Executable (27066/9/6)
4.5% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
1.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
0.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon b22b3d6545572b96 (2 x Formbook, 1 x Gh0stRAT, 1 x AgentTesla)
Reporter Anonymous
Tags:AgentTesla exe UPX zgRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
450
Origin country :
RO RO
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe
Verdict:
Malicious activity
Analysis date:
2024-03-28 09:15:21 UTC
Tags:
evasion stealer agenttesla
Link:
https://app.any.run/tasks/485caed4-0426-499f-8919-60675e184dbd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Restart of the analyzed sample
Launching a process
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Sending a custom TCP request
Forced shutdown of a system process
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fingerprint keylogger lolbin overlay packed packed packed shell32 upx
Link:
https://www.filescan.io/uploads/660534a5c114c71235720f6b/reports/af471e5c-5790-4563-8ac8-4b608f2db512/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d4967b04-b2ed-4f10-a712-3f51b77789d3
Result
Threat name:
AgentTesla, PureLog Stealer, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1416938
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Check if machine is in data center or colocation facility
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected Generic Downloader
Yara detected PureLog Stealer
Yara detected RedLine Stealer
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a/
Threat name:
Win32.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2024-03-28 09:13:08 UTC
File Type:
PE (Exe)
Extracted files:
36
AV detection:
19 of 24 (79.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eirxawlplemdaqdxf2lrzgzgfup2dk5fhbvujdschrwp6ljdggna._file
Verdict:
malicious
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:zgrat keylogger rat spyware stealer trojan upx
Link:
https://tria.ge/reports/240328-k6qx1seh59/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
AutoIT Executable
Suspicious use of SetThreadContext
Looks up external IP address via web service
UPX packed file
AgentTesla
Detect ZGRat V1
ZGRat
Malware Config
C2 Extraction:
https://api.telegram.org/bot6811787827:AAEr4cj8xrQKX5i6BnPzE4vzpRaL4EziTo4/
Unpacked files
SH256 hash:
7382e223a18655bf152f497ee4f84b3d77800212a137100ec14f3f45ac84df7d
MD5 hash:
047684068676a1b322fc566d804be882
SHA1 hash:
4d93afce8ccc8f253209481623ee1789fffe8ff5
Detections:
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
RedLine_Campaign_June2021
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/e7df0c85-0f8e-44fe-94d8-0dca56ff86a4/
SH256 hash:
58741e7e29bd877a2c4e51f2fea7b972a6d9b9ecec720d26f7fb997dd222bcaa
MD5 hash:
562d26a5fbac69677511537a1772a695
SHA1 hash:
2d9af0a738a88a920012dfdf0e3f65124880c6a8
Detections:
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/e7df0c85-0f8e-44fe-94d8-0dca56ff86a4/
SH256 hash:
44d1bcc9ba6209fbb3a7187de7330e02721bd44ee2ffed0e25b240a2b729d661
MD5 hash:
d1a6f0d9c808ff3fbbb73936b6377410
SHA1 hash:
b8d3e75d475b6a0388c67897d51fb59dea8e85d2
Detections:
MAL_Malware_Imphash_Mar23_1
Create hunting rule
MetaStealer_NET_Reactor_packer
Create hunting rule
MALWARE_Win_RedLine
Create hunting rule
Link:
https://www.unpac.me/results/e7df0c85-0f8e-44fe-94d8-0dca56ff86a4/
SH256 hash:
8a87a45dbcd63ff898d2c7087da7c448a137ff54f894e5b4251bd25801effedf
MD5 hash:
1a9eac67f2179d3f75bce5484e27b7db
SHA1 hash:
14919c527ba421a21c68ecd2bde083850f5323d6
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/e7df0c85-0f8e-44fe-94d8-0dca56ff86a4/
SH256 hash:
222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a
MD5 hash:
2c520c9db37e16343941bbba36fc22ef
SHA1 hash:
b168bb726e9ec94166e60cc3d502843058ede5a4
Detections:
MAL_Malware_Imphash_Mar23_1
Create hunting rule
Link:
https://www.unpac.me/results/e7df0c85-0f8e-44fe-94d8-0dca56ff86a4/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/222370596f59/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXv20MarkusLaszloReiser
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetAce
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA

Comments