MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2736d972a161e78ec13a41b3d56014f9ceca8bd8d6205aac0e54a6cf9a13842d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2736d972a161e78ec13a41b3d56014f9ceca8bd8d6205aac0e54a6cf9a13842d
SHA3-384 hash: cfdfeb9325355880c66685ec6962ab7cdd31feee4750199ed767253e57856d665bf1ce1d80ed73e294127c4dd947cfd9
SHA1 hash: f4076bbf43fb3ef657758a248add3f6ab83ea32c
MD5 hash: b15167c18d97ac90182df49851443e23
humanhash: beer-fruit-grey-beer
File name:ricevuta del bonifico.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:44'544 bytes
First seen:2021-04-26 08:25:50 UTC
Last seen:2021-04-26 08:56:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 768:2YuQ94FyrtXKAUn9AED/f/nbXmTA6UY53JZEpr3qXtg79e4Kpb:wQ94Wjw9/D/nnDJS53Jel4
Threatray 4'357 similar samples on MalwareBazaar
TLSH 35134A153180B116D1F7663549A3EB343374A3F26DA0860DEC92679CCD436E2BDCAADE
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ricevuta del bonifico.exe
Verdict:
Malicious activity
Analysis date:
2021-04-26 08:33:16 UTC
Tags:
trojan dtloader loader
Link:
https://app.any.run/tasks/0058ba03-f51a-4375-a599-1d43b5f2f641

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/144265/
Detection(s):
SecuriteInfo.com.Trojan.DownloaderNET.163.13357.30937.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Creating a file
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Launching a service
Sending a UDP request
Deleting a recently created file
Launching a process
Unauthorized injection to a recently created process
Creating a window
Using the Windows Management Instrumentation requests
Blocking the User Account Control
Adding exclusions to Windows Defender
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e3200ba1-c0f2-4077-9172-6ca57e9e759d
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/697572
Signature
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Found malware configuration
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 397703 Sample: ricevuta del bonifico.exe Startdate: 26/04/2021 Architecture: WINDOWS Score: 88 35 Found malware configuration 2->35 37 Yara detected AgentTesla 2->37 39 Yara detected AntiVM3 2->39 41 6 other signatures 2->41 7 ricevuta del bonifico.exe 21 8 2->7         started        process3 dnsIp4 33 xwjhdjylqeypyltby.ml 104.21.88.107, 49704, 80 CLOUDFLARENETUS United States 7->33 27 C:\Users\...\ricevuta del bonifico.exe.log, ASCII 7->27 dropped 29 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 7->29 dropped 43 Adds a directory exclusion to Windows Defender 7->43 12 AdvancedRun.exe 1 7->12         started        14 powershell.exe 26 7->14         started        16 powershell.exe 24 7->16         started        18 ricevuta del bonifico.exe 7->18         started        file5 signatures6 process7 process8 20 AdvancedRun.exe 12->20         started        23 conhost.exe 14->23         started        25 conhost.exe 16->25         started        dnsIp9 31 192.168.2.1 unknown unknown 20->31
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2736d972a161e78ec13a41b3d56014f9ceca8bd8d6205aac0e54a6cf9a13842d/
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
268f89bd4548d21dd1f6133a394327691e479443003cb92cdf9c0568a6b3ec41
AgentTesla
2b08660c05385174828189e7d4386af6e82dad631bf33a3ac6b75b1ee2928b51
AgentTesla
65a37fc31e46339de5ede41f1976ee5860f9c54573a510b6a73789c9ece66588
AgentTesla
7a932297ce3ab50a8990b122a596afa1d4229fb47040eea10934f720c1aef210
AgentTesla
8b74dd8b1c02a739ef72d1e34bf011c0838e83b9a16a1f7d3eec3bff7c572590
AgentTesla
9b501c547c3a6220c4ce9cec44811a2637adbbd3a11a0bf11ed437fde7747410
AgentTesla
a05b237bd950b290bde604ee1eb0682268195ce28a92dfc1b17c5085583dd107
AgentTesla
b4eddee0ed85389b25b45ad11c5ba9e581e667e6fc5aa32abae9d4c6b915845e
AgentTesla
bb5de34eed16e7157d51f93f11e1d135254a429ca8bea94d28e1bc55380ed1ad
AgentTesla
f9aa96b16ed15eeee83a9c47c1e682106d44281ea8d030e6cb1691852253aad6
AgentTesla
+ 4'347 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210426-cxcvtk2q7j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Windows security modification
Executes dropped EXE
AgentTesla Payload
Nirsoft
AgentTesla
Modifies Windows Defender Real-time Protection settings
Turns off Windows Defender SpyNet reporting
UAC bypass
Windows security bypass
Unpacked files
SH256 hash:
2736d972a161e78ec13a41b3d56014f9ceca8bd8d6205aac0e54a6cf9a13842d
MD5 hash:
b15167c18d97ac90182df49851443e23
SHA1 hash:
f4076bbf43fb3ef657758a248add3f6ab83ea32c
Link:
https://www.unpac.me/results/61fe56c5-e2b4-46a9-bfa6-5e31f75b7d0a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/2736d972a161e78ec13a41b3d56014f9ceca8bd8d6205aac0e54a6cf9a13842d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/144265/

Comments