MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 268a8cd2e1be94fb5124930ed021ef9cda228d8366efef29884f7affc47f936d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 268a8cd2e1be94fb5124930ed021ef9cda228d8366efef29884f7affc47f936d
SHA3-384 hash: 3ec3f0e326145ed01a0255076fb88e0d2682373261509601801d30cd6adf345cf9ae2206c025ce9bff58025e64a04554
SHA1 hash: c7af299beacbe30546b2748ea2007e26a6af686f
MD5 hash: b70240f09250a0f9f5d81184637ed32f
humanhash: seven-jig-river-april
File name:SwiftCopy.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:483'840 bytes
First seen:2020-10-20 07:25:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:J9EJ9wt2L2C1Iz0i1h4L9tRjj6CTW2XN:J4YC1Iz0ikFj/Z
Threatray 317 similar samples on MalwareBazaar
TLSH 86A4AFB27D96596EC96F077150A984C1FAB616C73F908B0D71AB430C0F11A2BFB6325B
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: serve0.sharkfloat.pw
Sending IP: 104.168.215.246
From: Account Payable <ap@Jagdambasteel.it>
Subject: FWD:RE:RE: Failed Transfer
Attachment: Swift Copy File2.iso (contains "SwiftCopy.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/73276/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% subdirectories
Creating a window
Running batch commands
Launching a process
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/497169
Signature
.NET source code contains very large array initializations
Creates an autostart registry key pointing to binary in C:\Windows
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 300747 Sample: SwiftCopy.exe Startdate: 20/10/2020 Architecture: WINDOWS Score: 84 32 Multi AV Scanner detection for dropped file 2->32 34 Multi AV Scanner detection for submitted file 2->34 36 Yara detected AgentTesla 2->36 38 3 other signatures 2->38 7 SwiftCopy.exe 8 2->7         started        11 OpenWith.exe 16 6 2->11         started        13 pcalua.exe 1 1 2->13         started        15 2 other processes 2->15 process3 file4 24 C:\Users\user\AppData\Local\app, PE32 7->24 dropped 26 C:\Users\user\AppData\...\app:Zone.Identifier, ASCII 7->26 dropped 28 C:\Users\user\AppData\...\SwiftCopy.exe.log, ASCII 7->28 dropped 30 C:\Users\user\AppData\Local\Temp\...\Xxl.dll, PE32 7->30 dropped 42 Tries to detect virtualization through RDTSC time measurements 7->42 17 cmd.exe 1 7->17         started        signatures5 process6 process7 19 reg.exe 1 1 17->19         started        22 conhost.exe 17->22         started        signatures8 40 Creates an autostart registry key pointing to binary in C:\Windows 19->40
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/268a8cd2e1be94fb5124930ed021ef9cda228d8366efef29884f7affc47f936d/
Threat name:
ByteCode-MSIL.Spyware.Tnega
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 22:50:15 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e2fizuxbx2kpwujesmhnaippttncfdmdm3x66kmij55p7rd7snwq._file
Verdict:
unknown
Similar samples:
223c38be022bf37ef243556438ecd472ae67bbb46fcf0e7ce4ea3173260141e9
AgentTesla
31e9e7ca798fc5177eb571c001d4d7ae44e141818fa31fb8fe654d44afe3df53
AgentTesla
5429b48434d8a47a26e25e4e54a326b30631e26427efa51afd94b4f1503c0695
AgentTesla
80f341333728513fea45dc07c8582e5a8c3ac630de39b53ef23d1742ddc0f5d2
AgentTesla
8c6c41d8e0f478b1be11b938bf83066e8cf7a8b294c18c91e0b2570f464bc6d2
AgentTesla
c3c933e8d5ebaa421d67aaf4c26be3c0368992133c3105fdd935470128910f6c
AgentTesla
c62ef08103c30d5d2d18fbc2eff820985af40aa377828ef72c3ecad495103511
AgentTesla
cf68e1b1e8e89cf03b0d721957c794936947c8cf5f8c30401c20e075e4b37c6e
AgentTesla
d9600ffc9406d71c60b7eb036248230510c3b971a1de563ca7b8b57e822f7879
AgentTesla
f4e60792b136f02c28fd35322ee58bf723aeaa3611d286417d8b2b0707612cdc
AgentTesla
+ 307 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/201020-rcjm8h67k2/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Adds Run key to start application
Loads dropped DLL
Unpacked files
SH256 hash:
268a8cd2e1be94fb5124930ed021ef9cda228d8366efef29884f7affc47f936d
MD5 hash:
b70240f09250a0f9f5d81184637ed32f
SHA1 hash:
c7af299beacbe30546b2748ea2007e26a6af686f
Link:
https://www.unpac.me/results/af0c1b1f-b616-4aec-a89a-563a023dcc01/
SH256 hash:
897f251e5ff09d4a3d0adfad920321df1b38deef0fdb9327ca23076421e74dfa
MD5 hash:
b2f18be35fb227b788854cf45f5bdbee
SHA1 hash:
a23e66384c7a783e42cf1055c8c47caafe2067be
Link:
https://www.unpac.me/results/af0c1b1f-b616-4aec-a89a-563a023dcc01/
SH256 hash:
9bec550624b5ebe019ea8952f9df0694a62a0fe02d6da901d0778bfbeb0ac219
MD5 hash:
292808395f593509fb3169d5dfba0749
SHA1 hash:
b3778f6c62472df1b896ff92e823409cdf87e225
Link:
https://www.unpac.me/results/af0c1b1f-b616-4aec-a89a-563a023dcc01/
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
Link:
https://www.unpac.me/results/af0c1b1f-b616-4aec-a89a-563a023dcc01/
Parent samples :
afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660
69e2ae11e1b5cbe120bf02301191a1cf05e87fc09b09d63bd782abbf3615d05d
0b778873c94f6bc89a40294c0e85a38ab82509260cd2a2e8b73d00c5c90e8757
7ddfa6f44a60f4b894321f6977f8121cfb371c3c61ac872c58ba61fd5ee13deb
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/268a8cd2e1be94fb5124930ed021ef9cda228d8366efef29884f7affc47f936d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 1ead542ec7dd120aaa3986f282dc35a0f1b6a7e0502d8104c11008569c388a02

AgentTesla

Executable exe 268a8cd2e1be94fb5124930ed021ef9cda228d8366efef29884f7affc47f936d

(this sample)

  
Dropped by
MD5 a610d428891120b3bd8aa5a0411342d8
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/73276/
  
Dropped by
SHA256 1ead542ec7dd120aaa3986f282dc35a0f1b6a7e0502d8104c11008569c388a02

Comments