MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36b46699b20b4ce357b902c256b8bd938898c79fd0894741173dc67843ec1700. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36b46699b20b4ce357b902c256b8bd938898c79fd0894741173dc67843ec1700
SHA3-384 hash: d941aa9b8cf9bcded6282112f6fce19fc2e6648627a90628ace6c6902723639cb939eeb8c358724676705941b042d3cc
SHA1 hash: b2b30b5a57e6f8f1f36a385b691bd1f0e4bd57b3
MD5 hash: 1b21040231567a32423b79ea6e4765ca
humanhash: johnny-video-blossom-connecticut
File name:Halkbank_Ekstre_20211020_101606_507653.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:49'664 bytes
First seen:2021-10-21 15:17:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 1536:hGKlmN09PM6ixeSSrSY4C6czESf9P/rIgoxeR:hGKGSOY4CHISFPjrDR
Threatray 551 similar samples on MalwareBazaar
TLSH T1FC236B5427888532C6AE237BD9A705C45370A3C66942EB2E6FC853F9AC077831F1679F
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
183
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/199124/
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.EHH.genEldorado.7610.8092.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a service
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Creating a file in the Windows subdirectories
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Deleting a recently created file
Blocking the Windows Defender launch
Adding exclusions to Windows Defender
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/617184aba9d585e6d53234fe/reports/ff82e882-4591-4a4b-9741-05614db4828d/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/77949396-897c-4bfa-98db-572bbeaad9e3
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/874689
Signature
Adds a directory exclusion to Windows Defender
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious names
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 507115 Sample: Halkbank_Ekstre_20211020_10... Startdate: 21/10/2021 Architecture: WINDOWS Score: 100 54 162.159.129.233, 443, 49767, 49768 CLOUDFLARENETUS United States 2->54 56 smtp.vivaldi.net 2->56 58 cdn.discordapp.com 2->58 66 Multi AV Scanner detection for submitted file 2->66 68 Yara detected UAC Bypass using CMSTP 2->68 70 Yara detected AgentTesla 2->70 72 4 other signatures 2->72 8 Halkbank_Ekstre_20211020_101606_507653.exe 23 9 2->8         started        13 svchost.exe 2->13         started        signatures3 process4 dnsIp5 60 cdn.discordapp.com 162.159.134.233, 443, 49763, 49764 CLOUDFLARENETUS United States 8->60 46 C:\Windows\Cursors\...\svchost.exe, PE32 8->46 dropped 48 C:\Windows\...\svchost.exe:Zone.Identifier, ASCII 8->48 dropped 50 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 8->50 dropped 74 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->74 76 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->76 78 Creates autostart registry keys with suspicious names 8->78 86 2 other signatures 8->86 15 AdvancedRun.exe 8->15         started        18 powershell.exe 24 8->18         started        20 powershell.exe 25 8->20         started        28 2 other processes 8->28 62 162.159.133.233, 443, 49765, 49766 CLOUDFLARENETUS United States 13->62 52 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 13->52 dropped 80 System process connects to network (likely due to code injection or exploit) 13->80 82 Multi AV Scanner detection for dropped file 13->82 84 Adds a directory exclusion to Windows Defender 13->84 22 powershell.exe 13->22         started        24 powershell.exe 13->24         started        26 powershell.exe 13->26         started        file6 signatures7 process8 dnsIp9 64 192.168.2.1 unknown unknown 15->64 30 AdvancedRun.exe 15->30         started        32 conhost.exe 18->32         started        34 conhost.exe 20->34         started        36 conhost.exe 22->36         started        38 conhost.exe 24->38         started        40 conhost.exe 26->40         started        42 conhost.exe 28->42         started        44 conhost.exe 28->44         started        process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36b46699b20b4ce357b902c256b8bd938898c79fd0894741173dc67843ec1700/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-10-21 14:29:54 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g22gngnsbngogv5zalbfnof5soejrr472ceuoqixhxdhqq7mc4aa._file
Verdict:
malicious
Similar samples:
2ac91449fd255e02594e29de0f1c66c70fb0ba1af3dd87846ffe3e21503ffb4d
AgentTesla
3866c650a1273493fa16bbd086f8ff0d9e4e57d9646857aace6bf7a32839a06d
AgentTesla
46de87ee14fc89de41df979d9de14bd223dbd109d7f9c04eda2641091d6d005b
AgentTesla
70cb4ed4ee85184589dc4b5bb72dd1313b133b428e6604bde1a7e1da7fb216ae
AgentTesla
a397a5fde8ef63a32f7867346eebabd48d1ddf0a60c0d95abf431d9d2c51e017
AgentTesla
c7ce97bf28191b9f81871421f7f6fea0c86fca516d3e8706e16c0f07e9e7ed5b
AgentTesla
d642eb17671f269eddc3d1045845374a45eda0a7c3fd197d8b7f6a3355ba01d6
AgentTesla
dcb7cdefcf20a1e8320b1f4e89f0b8ba4e43062da33ba5a4c422cd7b0046630a
AgentTesla
dfdf48403506835206467e72952fc59fa3fb3c9dabc36090e82979e0b3a624c7
AgentTesla
f14382a4d215270362d269bff86bbddf1ed085e20c36ae521e70ac85890e5179
AgentTesla
+ 541 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection evasion keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/211021-spk97sbdap/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Drops file in Windows directory
Accesses Microsoft Outlook profiles
Adds Run key to start application
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Windows security modification
Executes dropped EXE
AgentTesla Payload
Nirsoft
AgentTesla
Modifies Windows Defender Real-time Protection settings
Turns off Windows Defender SpyNet reporting
Windows security bypass
Unpacked files
SH256 hash:
36b46699b20b4ce357b902c256b8bd938898c79fd0894741173dc67843ec1700
MD5 hash:
1b21040231567a32423b79ea6e4765ca
SHA1 hash:
b2b30b5a57e6f8f1f36a385b691bd1f0e4bd57b3
Link:
https://www.unpac.me/results/8a8f5348-e1aa-41e0-84ff-12b67314a34c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/36b46699b20b4ce357b902c256b8bd938898c79fd0894741173dc67843ec1700

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 36b46699b20b4ce357b902c256b8bd938898c79fd0894741173dc67843ec1700

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/199124/

Comments