MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4297cc0becafda17d7a93b5b1933bf0f2e00777bb9d82da71203b51afed18ee3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4297cc0becafda17d7a93b5b1933bf0f2e00777bb9d82da71203b51afed18ee3
SHA3-384 hash: db96e05711595d545520348f8ecc232d1d1c16330d273a8a92084c13288ecd31592c1eaefc95ee2e7b1e4e79d585745e
SHA1 hash: 9eb2000a3736ee17ca66200f61937b66ba2c069d
MD5 hash: 51218c4b70b594079c88b2fd9bf44643
humanhash: nineteen-mars-sixteen-yankee
File name:Transferencia Copiar.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:353'421 bytes
First seen:2022-03-24 10:27:02 UTC
Last seen:2022-03-24 13:19:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 6144:rGiIc/Lo/3YStD5DQgdOyYcqzHwyHcT5CmMCjz3R+i:YQSpqnyYdQyHm5Cwjzsi
Threatray 19'614 similar samples on MalwareBazaar
TLSH T16D74224F6CC0A83BD90699368773F178637DC2A6023219ABDB202FE64F515CBD3526D6
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter pr0xylife
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
293
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/257133/
Detection(s):
SecuriteInfo.com.Variant.Jaik.52748.7559.16387.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Reading critical registry keys
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/623c478c0cd58dbd92e5fb99/reports/884eaed0-c5d4-425c-b071-04cf6fcdbe2e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4314f5c8-4008-4201-9855-a52687c5146f
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/963649
Signature
Changes security center settings (notifications, updates, antivirus, firewall)
Found malware configuration
Malicious sample detected (through community Yara rule)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: File Created with System Process Name
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 596130 Sample: Transferencia Copiar.exe Startdate: 24/03/2022 Architecture: WINDOWS Score: 100 37 Found malware configuration 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 Yara detected AgentTesla 2->41 43 Sigma detected: File Created with System Process Name 2->43 7 Transferencia Copiar.exe 18 2->7         started        10 svchost.exe 2->10         started        13 svchost.exe 1 1 2->13         started        16 7 other processes 2->16 process3 dnsIp4 29 C:\Users\user\AppData\...\pvqcgtjnwx.exe, PE32 7->29 dropped 18 pvqcgtjnwx.exe 7->18         started        57 Changes security center settings (notifications, updates, antivirus, firewall) 10->57 21 MpCmdRun.exe 1 10->21         started        35 127.0.0.1 unknown unknown 13->35 file5 signatures6 process7 signatures8 45 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 18->45 47 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 18->47 23 pvqcgtjnwx.exe 2 5 18->23         started        27 conhost.exe 21->27         started        process9 dnsIp10 31 mail.synaxisqatar.com 162.241.219.86, 49767, 587 UNIFIEDLAYER-AS-1US United States 23->31 33 x1.i.lencr.org 23->33 49 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 23->49 51 Tries to steal Mail credentials (via file / registry access) 23->51 53 Tries to harvest and steal ftp login credentials 23->53 55 Tries to harvest and steal browser information (history, passwords, etc) 23->55 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4297cc0becafda17d7a93b5b1933bf0f2e00777bb9d82da71203b51afed18ee3/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2022-03-24 10:27:12 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
7 of 42 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ikl4yc7mv7nbpv5jhnnrsm57b4xaa533xhmc3jysao2rv7wrr3rq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
46126fc4213a31ab8b8c0d29da390f4249bb80de317757c71732710375ccb9bc
AgentTesla
78626de6d56a42e31638f24a044d6082282e6f8d2d66ea2f5d4e65fe816a92ee
AgentTesla
79e83b0067743e159e8b9f689ed498ddd7ff706278e8414c37dac7ad5aba561a
AgentTesla
8c6441d2f5e108a63524430674b8f711cc7b218a2a06fa2c43e24b1de1d76088
AgentTesla
d8386b61dc23c554ffa380c7f45ae9184ce2e8048c9f78aca258fd381098c724
AgentTesla
f9fe6b62b2af1b4f6cf38d7526de1824b057220901e997dda4ee1083047e1753
AgentTesla
+ 19'604 additional samples on MalwareBazaar
Gathering data
Unpacked files
SH256 hash:
8b538d2bfb90bf647437b92e2bbae42dd6a539ecaf62e907a334ac85d1b0eab6
MD5 hash:
231f310bef96aaf5f5475a98eaff7260
SHA1 hash:
6b9949e5791c2d77f0036cfc2abc73bace8ed22c
Link:
https://www.unpac.me/results/d3a9650b-2476-4d4d-bff9-a7f7266ef79c/
SH256 hash:
f2c289402d8efa32beac6c86b6285a4e7729e56ed4f1df6b05cd2f28951f8f37
MD5 hash:
c889706f173ff3ae13cb48e7d7cdb023
SHA1 hash:
59be25740eda1887cdc530c0708c7f8cb28182e8
Link:
https://www.unpac.me/results/d3a9650b-2476-4d4d-bff9-a7f7266ef79c/
SH256 hash:
671af6ae874f9deac2a567783364e002496b7616f020e84587ece188b58e2b5a
MD5 hash:
cd598289986c96e3ea1f416e26b482c4
SHA1 hash:
f9ded1600c15fa4a0968fb4787e4f66329ce8cd1
Link:
https://www.unpac.me/results/d3a9650b-2476-4d4d-bff9-a7f7266ef79c/
SH256 hash:
4297cc0becafda17d7a93b5b1933bf0f2e00777bb9d82da71203b51afed18ee3
MD5 hash:
51218c4b70b594079c88b2fd9bf44643
SHA1 hash:
9eb2000a3736ee17ca66200f61937b66ba2c069d
Link:
https://www.unpac.me/results/d3a9650b-2476-4d4d-bff9-a7f7266ef79c/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/4297cc0becaf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/4297cc0becafda17d7a93b5b1933bf0f2e00777bb9d82da71203b51afed18ee3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/257133/

Comments