MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d32ec11bf2963e4a505853ea46c4b15b73ad0b435fd3f279d034480335901a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d32ec11bf2963e4a505853ea46c4b15b73ad0b435fd3f279d034480335901a9
SHA3-384 hash: ea592d059df41a94289bb4aa72cd7a2d488594ea6ae37223dd45e69042f3b8481435bf47e39ecd8e0cb3444a22ce4574
SHA1 hash: dbb6385a5acc6993e234d533b75bfc888dab8649
MD5 hash: c0ba88e93c37a5381ed30ebe13e3230d
humanhash: moon-mississippi-echo-neptune
File name:BL copy.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:489'911 bytes
First seen:2022-11-22 08:23:14 UTC
Last seen:2022-11-22 09:28:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 29b61e5a552b3a9bc00953de1c93be41 (174 x Formbook, 82 x AgentTesla, 81 x Loki)
ssdeep 6144:bEa0biTgOrovwH/BdHZONl0E5aHKVRjT8i1M1IeFZSjyhlk7NQr1LsPD4RtR0:YfyovWHONluHKVRjAiCuyh86BgD4l0
Threatray 19'995 similar samples on MalwareBazaar
TLSH T17EA44AF1317D83C3E1A19EB10F9A86B0B5F135AC98D0160DA0F59B2EE3D2395149D9EE
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon d4a6a494a48484a4 (65 x AgentTesla, 39 x Formbook, 8 x RemcosRAT)
Reporter cocaman
Tags:AgentTesla exe Maersk

Intelligence

File Origin
# of uploads :
2
# of downloads :
217
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
BL copy.exe
Verdict:
Malicious activity
Analysis date:
2022-11-22 08:25:09 UTC
Tags:
keylogger stealer agenttesla
Link:
https://app.any.run/tasks/d4d32b73-889d-46fb-bcaf-ed86267e50d0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/337103/
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.50.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Searching for the window
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Reading critical registry keys
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/637c8725bf871f68ac7db860/reports/0059d09e-2aaa-4c97-bcf3-31d0b6a982bc/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4f3d9bac-8ec5-48dc-8f18-f91fdcde77e2
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1118728
Signature
.NET source code contains very large array initializations
Creates multiple autostart registry keys
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 751440 Sample: BL copy.exe Startdate: 22/11/2022 Architecture: WINDOWS Score: 100 51 Snort IDS alert for network traffic 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 Yara detected AgentTesla 2->55 57 4 other signatures 2->57 7 BL copy.exe 18 2->7         started        10 rulqhky.exe 1 2->10         started        13 rulqhky.exe 1 2->13         started        process3 file4 33 C:\Users\user\AppData\...\aiikyaiziv.exe, PE32 7->33 dropped 15 aiikyaiziv.exe 1 3 7->15         started        59 Machine Learning detection for dropped file 10->59 19 WerFault.exe 4 10 10->19         started        21 conhost.exe 10->21         started        23 WerFault.exe 10 13->23         started        25 conhost.exe 13->25         started        signatures5 process6 file7 35 C:\Users\user\AppData\Roaming\...\rulqhky.exe, PE32 15->35 dropped 43 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->43 45 May check the online IP address of the machine 15->45 47 Machine Learning detection for dropped file 15->47 49 3 other signatures 15->49 27 aiikyaiziv.exe 17 4 15->27         started        31 conhost.exe 15->31         started        signatures8 process9 dnsIp10 37 api.telegram.org 149.154.167.220, 443, 49702 TELEGRAMRU United Kingdom 27->37 39 api.ipify.org.herokudns.com 52.20.78.240, 443, 49699 AMAZON-AESUS United States 27->39 41 api.ipify.org 27->41 61 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 27->61 63 Tries to steal Mail credentials (via file / registry access) 27->63 65 Creates multiple autostart registry keys 27->65 67 2 other signatures 27->67 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4d32ec11bf2963e4a505853ea46c4b15b73ad0b435fd3f279d034480335901a9/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-11-22 08:23:23 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=juzoyen7ffr6jjifqu7ki3clcw3tvufugx6t6j45anciam2zaguq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0567cb6c296cea3b751dcdaf5929995cad17ce0c59937064c8a0f12651014b72
AgentTesla
1932562dc1fc3dcea7da6d86ef26c12a34b0acce777807a5f0b4b5922950df05
AgentTesla
29f62f439141ded1b38ef98adb31a7504aea04ce96047a05b050a6723f94a458
AgentTesla
2a7f4ff5530858f39321d14a3d55315ed9c616cb352e080467968a8f7904849c
AgentTesla
31602473d531ad4d07ab7c5ef1a75f8c3d594fd626fb279028f37350cf91e5f3
AgentTesla
4593e86900b5369cb21afb62ac5209bbd6c5b9cc30c3e20d0f55b9c85f71146a
AgentTesla
64b497c548522493d43bceed2cc41630f90f044eee97c973aadf9a230d4ec500
AgentTesla
a2f90535274bd659bbe05e158249d8eb766b75fd803c0a1a5aacda3f808f68b4
AgentTesla
c7a4fff1122cdbc4427cb51deb67fb1e4cfdf7013af9d7fb31c60d7ede7eb979
AgentTesla
+ 19'985 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/221122-kap1vaaf6y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5663632223:AAG5KHZDs7KWoaqTYx3lSyFlOdfD9vGegQo/
Unpacked files
SH256 hash:
d7ce479fdd9e797f6b30d12011cb44f6faacb71c7d4a6ee7d06630af582fdb24
MD5 hash:
bb22d58e8a2865151dc93f908af9d223
SHA1 hash:
eb71358a02461777476aedbb3cf17eac06d47464
Detections:
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/b01e4269-ca60-4c9b-ac69-b210bdd8ef45/
SH256 hash:
455c8336e5c306c8247e66cab2755aad8efcd468c9b4257ca537c906ef6ec4e2
MD5 hash:
f024abaa17ad38a68550705f9027213e
SHA1 hash:
42a44556e867315d1ae9fb31887cd1213ba09f06
Link:
https://www.unpac.me/results/b01e4269-ca60-4c9b-ac69-b210bdd8ef45/
SH256 hash:
1d3019ff5f6a2d28f7d876fdbbc8acc1215368f3f562fa988f6bacba4f6b23d7
MD5 hash:
27d66b1f9d5a06f086d46350d0e27fe9
SHA1 hash:
c42051eccb3ffb7d12a18136a8f3aa702e038417
Link:
https://www.unpac.me/results/b01e4269-ca60-4c9b-ac69-b210bdd8ef45/
SH256 hash:
4d32ec11bf2963e4a505853ea46c4b15b73ad0b435fd3f279d034480335901a9
MD5 hash:
c0ba88e93c37a5381ed30ebe13e3230d
SHA1 hash:
dbb6385a5acc6993e234d533b75bfc888dab8649
Link:
https://www.unpac.me/results/b01e4269-ca60-4c9b-ac69-b210bdd8ef45/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4d32ec11bf29/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.93
Link:
https://yomi.yoroi.company/submissions/4d32ec11bf2963e4a505853ea46c4b15b73ad0b435fd3f279d034480335901a9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 8e6e39cf270a36e933a9d29563036afde6687360020117780c09a17127ab79af

AgentTesla

Executable exe 4d32ec11bf2963e4a505853ea46c4b15b73ad0b435fd3f279d034480335901a9

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 8e6e39cf270a36e933a9d29563036afde6687360020117780c09a17127ab79af
Cape
Cape
https://www.capesandbox.com/analysis/337103/
  
Dropped by
MD5 776e2c5ae23850e1e35b6a5987182b86

Comments