MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32edcbc565534dfe2c91695f8449a1abe8880e8f9d1b8daf6e58d95efc482bf9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32edcbc565534dfe2c91695f8449a1abe8880e8f9d1b8daf6e58d95efc482bf9
SHA3-384 hash: 20879095c714e0dd4680effee255bb8f55861cfb8d7573a31ace191a672000b6e8b5eb49da306cf83b7630f5c4bee7eb
SHA1 hash: a15d489e3710bfd32286798f41d72015fbe98cc7
MD5 hash: b361a14457781df913db8fcf6fbf5b94
humanhash: glucose-four-finch-sweet
File name:Dekont_PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:753'152 bytes
First seen:2022-04-12 12:20:06 UTC
Last seen:2022-04-12 13:25:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:AoV4qsgXT0MyIQf3YVuBTyoVTXb9lol8bfq7oGLA/dTBg6:AoyqHjnQf3Y+PFXb9D7aXLA/VS
Threatray 16'056 similar samples on MalwareBazaar
TLSH T148F4C019FAA6CE12EAA80737C0F7190807F1AA43D526D73F378166990D533A74D07B9B
File icon (PE):PE icon
dhash icon e4dcd8c4d4d4c4d4 (95 x AgentTesla, 51 x Formbook, 12 x RemcosRAT)
Reporter abuse_ch
Tags:AgentTesla exe geo TUR

Intelligence

File Origin
# of uploads :
2
# of downloads :
326
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Dekont_PDF.exe
Verdict:
Malicious activity
Analysis date:
2022-04-13 04:01:31 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/eff0fbee-83b3-431d-a2a9-3701e90f8beb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/263041/
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.GZQ.genEldorado.26681.27203.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe expand.exe obfuscated packed
Link:
https://www.filescan.io/uploads/62556e8ceab80a7a6c005a18/reports/63430129-b0c5-4683-a417-b2f3c486e9d8/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a0093635-a9dd-4b7e-b071-d8c9e00617ba
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/975319
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Accessing WinAPI in PowerShell. Code Injection
Sigma detected: Suspicious Add Scheduled Task From User AppData Temp
Sigma detected: Suspicious Remote Thread Created
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 607802 Sample: Dekont_PDF.exe Startdate: 12/04/2022 Architecture: WINDOWS Score: 100 65 Malicious sample detected (through community Yara rule) 2->65 67 Multi AV Scanner detection for dropped file 2->67 69 Multi AV Scanner detection for submitted file 2->69 71 10 other signatures 2->71 8 Dekont_PDF.exe 7 2->8         started        12 UXjBKpA.exe 2->12         started        14 UXjBKpA.exe 2->14         started        process3 file4 51 C:\Users\user\AppData\Roaming\PgZwQdnkH.exe, PE32 8->51 dropped 53 C:\Users\...\PgZwQdnkH.exe:Zone.Identifier, ASCII 8->53 dropped 55 C:\Users\user\AppData\Local\...\tmp81A8.tmp, XML 8->55 dropped 57 C:\Users\user\AppData\...\Dekont_PDF.exe.log, ASCII 8->57 dropped 83 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->83 85 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->85 87 Uses schtasks.exe or at.exe to add and modify task schedules 8->87 89 Injects a PE file into a foreign processes 8->89 16 Dekont_PDF.exe 8->16         started        21 powershell.exe 25 8->21         started        23 powershell.exe 24 8->23         started        25 schtasks.exe 8->25         started        91 Multi AV Scanner detection for dropped file 12->91 93 Machine Learning detection for dropped file 12->93 95 Adds a directory exclusion to Windows Defender 12->95 27 UXjBKpA.exe 12->27         started        29 powershell.exe 12->29         started        31 schtasks.exe 12->31         started        33 powershell.exe 12->33         started        signatures5 process6 dnsIp7 59 eylulteknik.com 109.232.216.173, 587 AEROTEK-ASTR Turkey 16->59 61 mail.eylulteknik.com 16->61 47 C:\Users\user\AppData\Roaming\...\UXjBKpA.exe, PE32 16->47 dropped 49 C:\Users\user\...\UXjBKpA.exe:Zone.Identifier, ASCII 16->49 dropped 73 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->73 75 Tries to steal Mail credentials (via file / registry access) 16->75 77 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->77 35 conhost.exe 21->35         started        37 conhost.exe 23->37         started        39 conhost.exe 25->39         started        63 mail.eylulteknik.com 27->63 79 Tries to harvest and steal ftp login credentials 27->79 81 Tries to harvest and steal browser information (history, passwords, etc) 27->81 41 conhost.exe 29->41         started        43 conhost.exe 31->43         started        file8 signatures9 process10 process11 45 conhost.exe 35->45         started       
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/32edcbc565534dfe2c91695f8449a1abe8880e8f9d1b8daf6e58d95efc482bf9/
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Create hunting rule
Status:
Malicious
First seen:
2022-04-12 07:57:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=glw4xrlfkng74lernfpyisnbvpuiqduptuny3l3oldmv57cifp4q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
4b0f3abe3b0c7a9356687b4c29c68f9bab4247ca92cf5c37b42eec2881d3d2ec
AgentTesla
58c4b64412b4dd61472d6df712f5ec38b7b2f8d88d6607b90804c4253b6400f4
AgentTesla
8dd2ea100a46b99ad89e7754af2dbd306ce5ec10e214687edd629aa6b7ab4cd6
AgentTesla
defbeba113680db4e014a2b34be77a64529d1e0d5fb837e732eec92b842d364d
AgentTesla
faf88b54daf7749226c2bf5fc4d0f122d728f689093c926f26c1d4b2c275f137
AgentTesla
fd9e418f40446055e165255d478ffe8c1f28bbc89d6147118c2c8d819dcd84b5
AgentTesla
+ 16'046 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220412-pjbl2aeeb9/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
6639369a833ae4f82578ce22368f95ea65b5c53f9e5da6c1b8e996332b397505
MD5 hash:
5161f66937f54eda1091c34df5a95b28
SHA1 hash:
a34635e0e4f8ab05db0c72e33ff8a7620f005582
Link:
https://www.unpac.me/results/c47c1f54-f415-4a8b-b1c9-7454a657be2d/
SH256 hash:
b4364bba1d1c0f9cd4f07899b646ab90c1fcee31a985cea8377960da1692903a
MD5 hash:
42d633e43e81a4b3b1e7c3e61a2bbcb4
SHA1 hash:
9e459eedfcd7d56b3917372066a55279e35a60fc
Link:
https://www.unpac.me/results/c47c1f54-f415-4a8b-b1c9-7454a657be2d/
SH256 hash:
130944720e8f3d0eb02cef8d23a70cfb3f282d10ac4f7ebb94731eb9b0018cbb
MD5 hash:
5f0418fed35452f4f4173470243f710d
SHA1 hash:
6be8e23fd2b73880bd23825139464fede4fc2752
Link:
https://www.unpac.me/results/c47c1f54-f415-4a8b-b1c9-7454a657be2d/
SH256 hash:
759a86d18f46d06ef3497af1c3c865cf1030d4c57479aaefc07d4351ca9d8ca1
MD5 hash:
28c0b030b61acf65d9736fb71b871e2e
SHA1 hash:
59fe15028e56ba48d28c772c2d0d09ebacd05dfc
Link:
https://www.unpac.me/results/c47c1f54-f415-4a8b-b1c9-7454a657be2d/
SH256 hash:
32edcbc565534dfe2c91695f8449a1abe8880e8f9d1b8daf6e58d95efc482bf9
MD5 hash:
b361a14457781df913db8fcf6fbf5b94
SHA1 hash:
a15d489e3710bfd32286798f41d72015fbe98cc7
Link:
https://www.unpac.me/results/c47c1f54-f415-4a8b-b1c9-7454a657be2d/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/32edcbc56553/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/32edcbc565534dfe2c91695f8449a1abe8880e8f9d1b8daf6e58d95efc482bf9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/263041/

Comments