MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2be71dbd5717aadd41efe306affff9fb63675adb1dd4f1a5a7b5d123c4ba508b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments 1

SHA256 hash:	2be71dbd5717aadd41efe306affff9fb63675adb1dd4f1a5a7b5d123c4ba508b
SHA3-384 hash:	94d2015fed40854585f78b3970b53ad9bf0ddb323bedd3f724549c3dec7cd3aa7d36a1041d64839e8089c608cff67882
SHA1 hash:	fbc95ce6a605fa4904d17b7403ba39195919ee59
MD5 hash:	f700a3aecc0229163f39fea344c3ced6
humanhash:	hawaii-bluebird-blue-finch
File name:	f700a3aecc0229163f39fea344c3ced6
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	691'200 bytes
First seen:	2023-06-01 06:04:26 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:O/R7DNXIEiAgnycthytTNCRMyp6ZWe9bk+7IQpMjx:iXNYfBnyOQtJJypYhBMjx
Threatray	3'274 similar samples on MalwareBazaar
TLSH	T123E45CD20C6742C6DDF54F344039361C2B78AA43ECD480AE7599719FCBF999388A5BE2
TrID	63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	zbetcheckin
Tags:	32 AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

259

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Purchase order (MACL202324398).xls

Verdict:

Malicious activity

Analysis date:

2023-06-01 05:22:51 UTC

Tags:

exploit cve-2017-11882 loader

Link:

https://app.any.run/tasks/1ec4312a-f0d8-4549-9358-1071c2c814da

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

XorStringsNET

Link:

https://www.capesandbox.com/analysis/394304/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.67327326.31789.31111.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Launching a process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

barys comodo lokibot packed

Link:

https://www.filescan.io/uploads/64783512771a36fa0d4fad3a/reports/28a58f7d-bc05-43c2-bc43-dcba26fbde46/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/2be71dbd5717aadd41efe306affff9fb63675adb1dd4f1a5a7b5d123c4ba508b

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3ba3901b-6497-4b09-8e06-fc3d66089033

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1246591

Signature

.NET source code contains potential unpacker

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/2be71dbd5717aadd41efe306affff9fb63675adb1dd4f1a5a7b5d123c4ba508b/

Threat name:

ByteCode-MSIL.Trojan.CobaltStrike

Status:

Malicious

First seen:

2023-05-31 21:41:18 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fptr3pkxc6vn2qpp4mdk777z7nrwoww3dxkpdjnhwxishrf2kcfq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

207101f6912ab3d1db4eb31783037685cade90fbc6ed91dffc1c53138b8436ff

AgentTesla

251ca0215e976403d529fba60bd67ca614a3e6b18a7f2420c64acbf31400ed7c

AgentTesla

74d26f4b119393b4528ff36ae1ed9ddf2fd9b6e36f3dbd9c7456ad692687905c

AgentTesla

bb992023216a9723d9157cacbe3f2dec846902eacce0122734d6111c85ee6309

AgentTesla

fbdd2e5779904ac37f1a5322c29bc20cae75832553a0f519ed5f23a15e7f86ab

AgentTesla

+ 3'264 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230601-gs6vjadd4w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AgentTesla

Unpacked files

SH256 hash:

a7e471f7bc560488312d57e885bb4cfc423587a0d84abbb3073a820f7cd0e209

MD5 hash:

e7709a907be0cdb6ff7eb99daee97c6c

SHA1 hash:

bb3f6871c40f54070b53947bf6958d410ea8bac1

Link:

https://www.unpac.me/results/f75a3197-3760-4da9-90ac-c965f344fa6b/

SH256 hash:

ff9d31d50bf02cf64a79931c714f8afe22cb2c1f46f7018f728673a13c7716a7

MD5 hash:

b5f759cdaeb4c43a720bd7b3625f0176

SHA1 hash:

5eb5e0130289611a41117f0746b9cd3d7ee8ba9c

Link:

https://www.unpac.me/results/f75a3197-3760-4da9-90ac-c965f344fa6b/

SH256 hash:

f5f0576064260ca8994961e9bac29e51ad52cc7473d52f1379d5c533a40beae3

MD5 hash:

b2ed9276e6686711ed5ec6a3a1342147

SHA1 hash:

533064433d0a15f8a28f79bbe8b8ea5b5ad37ffd

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/f75a3197-3760-4da9-90ac-c965f344fa6b/

Parent samples :

cb3964a3b6a2ee8bd2bdbc3a3b65306546cecec2deb444968ee8f33ce2c1a593
2be71dbd5717aadd41efe306affff9fb63675adb1dd4f1a5a7b5d123c4ba508b
c45219a3fd0cf51360c30b7aa0cba985ad1d28030785ab9dc5083090540409d8
3e1f623f0b2c1b85bcbca396bbeb79e06db39138a004c14201827ed1a8ca377a
a9adeec302ab071989a321a13b0c9b1f12e4c0fd69f3dab0a99e46d165a40cd3
2406e6d5ca634a5b588ee4bd967cc1ac4ace9e24ac4761471c992f4a1450469f
7cae209399f08c5a85de444babd258aadb253b625356dcd47e4ccf4fca8a013e
db4298e6b1ab62b76c39dbedd3bedcef513acf96a75cc97eabf9f82741027ea5

SH256 hash:

2be71dbd5717aadd41efe306affff9fb63675adb1dd4f1a5a7b5d123c4ba508b

MD5 hash:

f700a3aecc0229163f39fea344c3ced6

SHA1 hash:

fbc95ce6a605fa4904d17b7403ba39195919ee59

Link:

https://www.unpac.me/results/f75a3197-3760-4da9-90ac-c965f344fa6b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/2be71dbd5717aadd41efe306affff9fb63675adb1dd4f1a5a7b5d123c4ba508b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

exe 2be71dbd5717aadd41efe306affff9fb63675adb1dd4f1a5a7b5d123c4ba508b

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/394304/

URLhaus

https://urlhaus.abuse.ch/url/2648516/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-06-01 06:04:26 UTC

url : hxxp://107.172.130.135/chu.exe