MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 444b5bc25382f88b8f263543d0b6a1074682f4173be393dae7ed02d6e639f629. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 444b5bc25382f88b8f263543d0b6a1074682f4173be393dae7ed02d6e639f629
SHA3-384 hash: 434dc402e2237c7df12a7c346aa81bf8f03c9ad23ae5901061763875c2331bb2681a722be12829d67dacc3fdf572b974
SHA1 hash: cb4521fef7e32e0ef8a67cb903c357330e01835c
MD5 hash: e4a08ad5c2dac6cca0e38da6f25073b9
humanhash: don-carbon-queen-thirteen
File name:TQZ23 DESCO MC.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'523'712 bytes
First seen:2021-06-07 10:45:40 UTC
Last seen:2021-06-14 06:38:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:HK+9Dlo8AnUVYtXiZmptNcTkyk0bsuAv60HA37dBGmA:Rxo8AnUYtXiZmXNktk0suwy9
Threatray 5'671 similar samples on MalwareBazaar
TLSH 0A659D223798A51BE27E92713574050882F6BE4AD576DB7EFD8472CF0DF1A009311BAB
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
TQZ23 DESCO MC.exe
Verdict:
Malicious activity
Analysis date:
2021-06-07 10:46:23 UTC
Tags:
keylogger stealer agenttesla
Link:
https://app.any.run/tasks/17b2e297-a019-4771-ad1b-76efef762358

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/164976/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.ABIB.10389.2341.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/798022
Signature
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Modifies the hosts file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 430418 Sample: TQZ23 DESCO MC.exe Startdate: 07/06/2021 Architecture: WINDOWS Score: 100 62 Found malware configuration 2->62 64 Yara detected AgentTesla 2->64 66 Yara detected AgentTesla 2->66 68 5 other signatures 2->68 7 TQZ23 DESCO MC.exe 7 2->7         started        11 NewApp.exe 5 2->11         started        13 NewApp.exe 4 2->13         started        process3 file4 46 C:\Users\user\AppData\Local\...\tmpEAA0.tmp, XML 7->46 dropped 48 C:\Users\user\AppData\Roaming\SChppR.exe, PE32 7->48 dropped 70 Injects a PE file into a foreign processes 7->70 15 TQZ23 DESCO MC.exe 2 5 7->15         started        20 schtasks.exe 1 7->20         started        72 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->72 74 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 11->74 22 schtasks.exe 1 11->22         started        24 NewApp.exe 11->24         started        26 NewApp.exe 11->26         started        28 NewApp.exe 11->28         started        30 NewApp.exe 13->30         started        32 schtasks.exe 13->32         started        signatures5 process6 dnsIp7 50 buynsell.com.pk 194.28.84.37, 49741, 587 HOSTPRO-ASUA Ukraine 15->50 52 mail.buynsell.com.pk 15->52 40 C:\Users\user\AppData\Roaming\...40ewApp.exe, PE32 15->40 dropped 42 C:\Users\user\...42ewApp.exe:Zone.Identifier, ASCII 15->42 dropped 54 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->54 56 Tries to steal Mail credentials (via file access) 15->56 58 Tries to harvest and steal ftp login credentials 15->58 60 4 other signatures 15->60 34 conhost.exe 20->34         started        36 conhost.exe 22->36         started        44 C:\Windows\System32\drivers\etc\hosts, ASCII 30->44 dropped 38 conhost.exe 32->38         started        file8 signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/444b5bc25382f88b8f263543d0b6a1074682f4173be393dae7ed02d6e639f629/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-07 09:46:05 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=irfvxqstql4ixdzggvb5bnvba5dif5axhprzhwxh5ubnnzrz6yuq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
25cf729d7aa6237c733f37219f95dddc7428f459bb18d49a7b6f9f0014c4c9e3
AgentTesla
44b5209fadd63026c1f4c7f1d1a6b9f49aa76f8597579773a0bc0010bada5853
AgentTesla
8252ac25f576f23a6225b5bba0fc2936be9e3d1444d54567d672e40a81c8b819
AgentTesla
97660b0a53d557551f406f971bada8f0018180ae891ae43eca4965fee9eb187b
AgentTesla
991a74bfa1338d3ff4e513f174dd7ee9abee5b83a799b754217af30df6857049
AgentTesla
a2059d974b96a04e44f1197d988cc4d281c448ce5bf521cdf1476afb2bdd4b93
AgentTesla
b95c99701d429de9d8f52792d7a2b462ec6e342618a04ef419710b42e76293ff
AgentTesla
c479ffce9f101b07f4f6983b3f90f7187966554681051145610b16d84dfc59ed
AgentTesla
c8f972ce679b3339b92813e06e995eb5d3795c5481bd9bf6e5d5fca97748caec
AgentTesla
e8b4a3da8520ef2fef960477140ece178120610dd34bcaa4c9d0d475ebdffd9c
AgentTesla
+ 5'661 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210607-xhk5d4xjr2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
34e69e90b7cb6121c3f93911f21dfb00491ea5d5bb79bfce4902d04f72c24184
MD5 hash:
b6b086a0ab13f3feb9ee8c846d230e5d
SHA1 hash:
dd8e1b816f3e7d9dcfa6eddc20a27fe0fbed478a
Link:
https://www.unpac.me/results/2c962260-8a8e-4b65-99b8-34538287dbe1/
SH256 hash:
444b5bc25382f88b8f263543d0b6a1074682f4173be393dae7ed02d6e639f629
MD5 hash:
e4a08ad5c2dac6cca0e38da6f25073b9
SHA1 hash:
cb4521fef7e32e0ef8a67cb903c357330e01835c
Link:
https://www.unpac.me/results/2c962260-8a8e-4b65-99b8-34538287dbe1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/444b5bc25382f88b8f263543d0b6a1074682f4173be393dae7ed02d6e639f629

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 444b5bc25382f88b8f263543d0b6a1074682f4173be393dae7ed02d6e639f629

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/164976/

Comments