MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 237cd47fd12fbd8271d92b8b3d525ca43ec6743d273e215b0eafd912e79253d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 237cd47fd12fbd8271d92b8b3d525ca43ec6743d273e215b0eafd912e79253d6
SHA3-384 hash: 06fdafabaf1af72be3e99f4a427533b86dd7fa59fc0cfa1530d624d4673ee8cc521fca814536305ef101cd32e357c6cf
SHA1 hash: dcb49871680b73f98100616e6c7278507558772c
MD5 hash: 7ff10e7bb2a9adb9b51fa8ad94284019
humanhash: double-november-spring-nevada
File name:quotation pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:988'672 bytes
First seen:2021-07-13 13:00:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:MnXN5GnTOdU+CHpZgQx6YCLvsm1XWocQ1txea7bmgfcuLruWcEObUBJRkKQgGHn2:3x6YeD77SwbLruWcBiJeKtHc
Threatray 6'659 similar samples on MalwareBazaar
TLSH T1CD258B6C27BEA408F637FE709FA0B2B59E667EB59225944D19C03E067431C80EE77931
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
quotation pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-07-13 13:15:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9ae81d2e-55be-4a21-b3b3-e6cb1178c7aa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171404/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.925-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bc5dab54-f81a-4206-b1a3-a0b10ea5c83a
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/815671
Signature
.NET source code contains very large array initializations
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 448083 Sample: quotation pdf.exe Startdate: 13/07/2021 Architecture: WINDOWS Score: 100 26 Found malware configuration 2->26 28 Multi AV Scanner detection for dropped file 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 10 other signatures 2->32 7 quotation pdf.exe 7 2->7         started        process3 file4 18 C:\Users\user\AppData\...\JoebKvZIVkGok.exe, PE32 7->18 dropped 20 C:\...\JoebKvZIVkGok.exe:Zone.Identifier, ASCII 7->20 dropped 22 C:\Users\user\AppData\Local\...\tmpE2F1.tmp, XML 7->22 dropped 24 C:\Users\user\...\quotation pdf.exe.log, ASCII 7->24 dropped 10 schtasks.exe 1 7->10         started        12 quotation pdf.exe 2 7->12         started        14 quotation pdf.exe 7->14         started        process5 process6 16 conhost.exe 10->16         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/237cd47fd12fbd8271d92b8b3d525ca43ec6743d273e215b0eafd912e79253d6/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2021-07-13 11:55:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=en6ni76rf66ye4ozfoft2us4uq7mm5b5e47ccwyov7mrfz4skpla._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
086b930d1a631edf83cfe41204603a67e9cf4661ecee97761f7dcb8f87bb6e70
AgentTesla
2361e8542045dddfaa5e2e6dfc49db670b687dcfa00e7877830de468bc076e38
AgentTesla
528c4017fc8019572354de7746bba7978bb1ce0c9508e42644799712fb5ea869
AgentTesla
5bb1ec5f6be562ca2beec31d45c6cce4b811283b225e3f2654dbfbe5cc8f07de
AgentTesla
988015476a43d916c6d49009eaa2e262246ac18eaf1615113262cd3540708450
AgentTesla
9c945e3dd82b26e5b6e2bc96a1aa6fdc1365235e6479c143340073fc831048fe
AgentTesla
c6cacd1d2bfb210318a62cabce8045f5735cd9a0e58c3aea8d3ec2174f6d7abb
AgentTesla
c7607bcbc0acfdf8733dff8a4f709009236da553d300abc2d0df98b3e6c70f58
AgentTesla
df54a04599bb3953ffcf067a4308e01dafe8ac2c9064bdd3fbc3a441725a06f2
AgentTesla
fe71bef6acadf2feb1a19c9e51543be0cacb245a5ce034b7510c72912996580e
AgentTesla
+ 6'649 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210713-etrpnn4eg2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
AgentTesla Payload
Looks for VirtualBox Guest Additions in registry
AgentTesla
Unpacked files
SH256 hash:
0e805536072bad719a3b92425c0d4b055bc28dbd0caa4f5cbb9e1f26e99c4833
MD5 hash:
d4f32e76b798d71caf05fcf35583f69c
SHA1 hash:
0267272141a96b156fe769e3733a2e727cf53a2f
Link:
https://www.unpac.me/results/16b7bc45-c610-4ec5-a421-e88dccc07f1c/
SH256 hash:
e8bf1ddf5e08c1c147f3a1a3f4491e1b25dcc8301fc02cd7c4fa43e8e360f2c8
MD5 hash:
64198544be7394f53cf0ad2b92c2bda1
SHA1 hash:
e5b1b1376df1f5a40b126e481a84ce3a0c559cc8
Link:
https://www.unpac.me/results/16b7bc45-c610-4ec5-a421-e88dccc07f1c/
SH256 hash:
79adf87c9a1bbbed646a81e68d03164dd704ce093f2c27a8174618dfbabb7f4b
MD5 hash:
50976bce9fe3d91814f9f8523489c7df
SHA1 hash:
333f7047140425628d75156535928ccc5fa89ce5
Link:
https://www.unpac.me/results/16b7bc45-c610-4ec5-a421-e88dccc07f1c/
SH256 hash:
5f5257e30cfc2caab058013ffc60f90fb8a5d780a14834e1371054290b7658e4
MD5 hash:
b0e14c3526d6623ae9b7b5f5e0efde76
SHA1 hash:
f7d127bff2dfb1100ebd55fdd12dfb7a2b382fdc
Link:
https://www.unpac.me/results/16b7bc45-c610-4ec5-a421-e88dccc07f1c/
SH256 hash:
237cd47fd12fbd8271d92b8b3d525ca43ec6743d273e215b0eafd912e79253d6
MD5 hash:
7ff10e7bb2a9adb9b51fa8ad94284019
SHA1 hash:
dcb49871680b73f98100616e6c7278507558772c
Link:
https://www.unpac.me/results/16b7bc45-c610-4ec5-a421-e88dccc07f1c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/237cd47fd12fbd8271d92b8b3d525ca43ec6743d273e215b0eafd912e79253d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/171404/

Comments