MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5024f86a2a158f964ce6833a7920c53e7962d0db4a542f4656267f46b55a57ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5024f86a2a158f964ce6833a7920c53e7962d0db4a542f4656267f46b55a57ef
SHA3-384 hash: d32551016146099f2d4360a75b81b94e1a1e4313d4af8767cfabbc7fac9ca9fd29e29eeab9825b17a2ef98790eb4f006
SHA1 hash: a13c183fb710f3b7e828dfb8ff48a609341677ba
MD5 hash: 437d6db99b07aa14e1c86b82f3616082
humanhash: saturn-pluto-island-california
File name:Company Docs.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:9'476'312 bytes
First seen:2021-01-13 02:45:39 UTC
Last seen:2021-01-13 04:42:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 768:WkCgNnDJkuyVeTEg77a4U61uwsWz8GbqRbw7PHNAEbyyT6Z6VW11116yD1111JGb:WkCgNnmFVebruwbz8GTNPzT6Z8
Threatray 15 similar samples on MalwareBazaar
TLSH C4A6DC39DD972226D433235CA680692DDA446F752BAD849B30B7A22DFEC70104F9DE7C
Reporter FORMALITYDE
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
198
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Company Docs.exe
Verdict:
Malicious activity
Analysis date:
2021-01-13 08:20:25 UTC
Tags:
evasion trojan rat quasar
Link:
https://app.any.run/tasks/85c99eea-ea42-4fd3-a603-c51c3efd164d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/111663/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.503.16256.1096.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Using the Windows Management Instrumentation requests
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Creating a file in the %AppData% directory
Launching a process
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Enabling autorun
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/579680
Signature
Connects to a pastebin service (likely for C&C)
Connects to many ports of the same IP (likely port scanning)
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Drops PE files to the startup folder
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 338884 Sample: Company Docs.exe Startdate: 13/01/2021 Architecture: WINDOWS Score: 100 51 pastebin.com 2->51 53 ip-api.com 2->53 63 Multi AV Scanner detection for dropped file 2->63 65 Multi AV Scanner detection for submitted file 2->65 67 May check the online IP address of the machine 2->67 69 8 other signatures 2->69 8 Company Docs.exe 19 9 2->8         started        13 Company Docs.exe 2->13         started        15 Venom.exe 2->15         started        17 Company Docs.exe 7 2->17         started        signatures3 process4 dnsIp5 55 54.39.152.114, 21, 49719, 49721 OVHFR Canada 8->55 57 ip-api.com 208.95.112.1, 49717, 49736, 49738 TUT-ASUS United States 8->57 59 pastebin.com 104.23.99.190, 443, 49718, 49737 CLOUDFLARENETUS United States 8->59 45 C:\Users\user\AppData\...\Company Docs.exe, PE32 8->45 dropped 47 C:\Users\...\Company Docs.exe:Zone.Identifier, ASCII 8->47 dropped 71 Creates an undocumented autostart registry key 8->71 73 Hides that the sample has been downloaded from the Internet (zone.identifier) 8->73 19 cmd.exe 1 8->19         started        21 cmd.exe 1 8->21         started        23 cmd.exe 1 8->23         started        25 8 other processes 8->25 49 C:\Users\user\AppData\Roaming\Venom.exe, PE32 13->49 dropped 75 Creates autostart registry keys with suspicious names 13->75 77 Creates multiple autostart registry keys 13->77 79 Multi AV Scanner detection for dropped file 15->79 81 Machine Learning detection for dropped file 15->81 61 104.23.98.190, 443, 49739, 49743 CLOUDFLARENETUS United States 17->61 file6 signatures7 process8 process9 27 netsh.exe 3 19->27         started        29 conhost.exe 19->29         started        31 netsh.exe 3 21->31         started        33 conhost.exe 21->33         started        35 netsh.exe 3 23->35         started        37 conhost.exe 23->37         started        39 netsh.exe 3 25->39         started        41 netsh.exe 3 25->41         started        43 12 other processes 25->43
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5024f86a2a158f964ce6833a7920c53e7962d0db4a542f4656267f46b55a57ef/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kaspq2rkcwhzmthgqm5hsigfhz4wfug3jjkc6rswez7unnk2k7xq._file
Verdict:
unknown
Similar samples:
263c44c0debf596d893d64e491c6ba5f31ccc06171fdd41abff109788a05ccec
AgentTesla
2adb3505038e73bc83e5c5d9a60b725645fb65a7b0a781a5aadde50c942d13dc
AgentTesla
4d6b2ca9c6a2ac2f7fc682f093035f01cf18b2f3aca553299316616d46b46a11
AgentTesla
72c2e8990fede91615555d69a7bfe061476e56e3fd4b4bf86217aa9ae816c571
AgentTesla
738e16b6660e32ed957f9fd9e0c5cea56b1aaa7695bcdb56998ca9866071e32b
AgentTesla
8890e3a0436c06a1c1d723352fd159a75e492cf3007f727f38183bbb8b79828e
AgentTesla
896983bee32da4a300d89878e8c5f284dec5288d60b3610439146f46cb59fbe8
AgentTesla
abd18b2d7cfc702e56442f2549808b301f2e0fc214cdf2230d5fbefc9620fd42
AgentTesla
bb3f58303f485aae5008474b5728f5f5dddea88b517835da3e402e0cafa53253
AgentTesla
c39bdd8f7c69c3140ef920e2b1d5965310058c5fa425b871f4d7751d8291d55e
AgentTesla
+ 5 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210113-9a7jcnxrye/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
AgentTesla Payload
AgentTesla
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
afeb45bfa94563d834431b4ac8d8ddd7ed736f7f990617a5ef625cc5b65d0888
MD5 hash:
8dde03dc6c46d07533c328486eba8508
SHA1 hash:
06b0b5b3f97e5df6748b8fef245e2d15e60d7f00
Detections:
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/cc3f16ee-83cc-4b22-80c3-13e71196e6dc/
SH256 hash:
3a96d9a797a3b6b3ea0d8264ed1078508df9557e2f453217d52a75907f9b9465
MD5 hash:
547ebc92cac936d8c3459d2765948f4a
SHA1 hash:
09c143d609b65b19a97289ca7645df2a0bc39c83
Link:
https://www.unpac.me/results/cc3f16ee-83cc-4b22-80c3-13e71196e6dc/
SH256 hash:
ae8abf10e555cee9769abea0e2d3379b11bc6a817f75a0b6038d294fa3d6a136
MD5 hash:
ad42d271e4b7d5c14c179c6cbe559bef
SHA1 hash:
3cf564330231eedce6458836b03e3c129c799b47
Link:
https://www.unpac.me/results/cc3f16ee-83cc-4b22-80c3-13e71196e6dc/
SH256 hash:
ba9192205adfb7bae34a4b2ecd752d9af03d0829f21d355536eaa1a9c5f3ed92
MD5 hash:
69de753f5c6ffd1dd146988fa7f0b6f3
SHA1 hash:
41608e3df1bd21db53744e3e920481d5ff1a750e
Link:
https://www.unpac.me/results/cc3f16ee-83cc-4b22-80c3-13e71196e6dc/
SH256 hash:
55e34ea99c2f53ac39f2873b6467c98ea626f441dd61cbce9f3462444db0401a
MD5 hash:
8d3eaf64ae8460689e95294dedf13480
SHA1 hash:
45217d5e5599c8b811883666e2735740e5d98453
Detections:
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/cc3f16ee-83cc-4b22-80c3-13e71196e6dc/
SH256 hash:
c1428ec7129ad3e36dad35d8992602cefcd6a593952834897424314fe029dd4b
MD5 hash:
67ca4c5eed9cab4b08064d4314dc0a86
SHA1 hash:
61dfa1d80d9e6b506d29e3897dd3ca08ade30988
Link:
https://www.unpac.me/results/cc3f16ee-83cc-4b22-80c3-13e71196e6dc/
Parent samples :
a53a585de940ceb15a7b30f6d6157b0e9722d7b81cea4a2dadb1f0c7410fae87
e2cc914a1df535f2cf88007a518a9990afe5ccdb9cf1262e550e2ce8cc9c7eb0
fbe788dd0db451b33c60b855c9aa18af0d2b87140cfa25a0a78be290d10089cc
ace5504608d43d701becbb246abe3c7b0483fd3904c13a5677084e6f98ef0271
d4e3e9ccf34249744cc8bbeba02fb11626604b8093edc8d85326b467e6aeb7b1
326e0518dab187c2786ffb1429a71dc764ef82211aaf59bcd3a8a78c01579283
2a8c219afd3d9e171dc1515b32185bad9172bbcdaf15a6a7502458b6e7553ff5
8c5659ff1e439fdb199c25ac76fb8d3e9c45b702ac8c99073ccdf7fd1f9cdbfd
SH256 hash:
a8c1d8c0a8b574c5ab920766ee55320cb5df67f1850489b72093b38cbcfd8098
MD5 hash:
c8b2d12b76c1bb22363639e7aa85548c
SHA1 hash:
a9972d09abde7bd4ae7c9272d745d5a39ff7795a
Detections:
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/cc3f16ee-83cc-4b22-80c3-13e71196e6dc/
SH256 hash:
c3e80fb7def7d117f69a8c2afb1a44c1a64a7bd1121eed1548b71d37074004d8
MD5 hash:
411ca779fe8e7349306ebc6ae4ad9367
SHA1 hash:
af017daae6a0843a62c5279f355a81d0670f4ecf
Detections:
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/cc3f16ee-83cc-4b22-80c3-13e71196e6dc/
SH256 hash:
0e95562c4a84e4ca5aaacfdf337f854bb0adbe82d0519bbecabc543c89b7ae8d
MD5 hash:
deb1c0d2a14ca6477dc842bea587e889
SHA1 hash:
b0e206ea2b06b8bf682d3e37c93a617c8a7d62c2
Detections:
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/cc3f16ee-83cc-4b22-80c3-13e71196e6dc/
SH256 hash:
2046b71d9bac2db15ff873672b004f845dd0e2200207cdc8dda0ec50ba15dd08
MD5 hash:
5a277ba128f7e9e827b58251dff0447b
SHA1 hash:
c406317e2971787e882fc22dbf3f14795159fe91
Link:
https://www.unpac.me/results/cc3f16ee-83cc-4b22-80c3-13e71196e6dc/
SH256 hash:
542be6a092437c47aec4c046bf4636f9a3153954b0384141b8cc2922d68a38b5
MD5 hash:
bfb7da75069724d5ec80b44bc2e46d9f
SHA1 hash:
fe757e6a079f7be6efa5d15df7260792560f6576
Link:
https://www.unpac.me/results/cc3f16ee-83cc-4b22-80c3-13e71196e6dc/
SH256 hash:
5024f86a2a158f964ce6833a7920c53e7962d0db4a542f4656267f46b55a57ef
MD5 hash:
437d6db99b07aa14e1c86b82f3616082
SHA1 hash:
a13c183fb710f3b7e828dfb8ff48a609341677ba
Link:
https://www.unpac.me/results/cc3f16ee-83cc-4b22-80c3-13e71196e6dc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5024f86a2a158f964ce6833a7920c53e7962d0db4a542f4656267f46b55a57ef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 5024f86a2a158f964ce6833a7920c53e7962d0db4a542f4656267f46b55a57ef

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/111663/

Comments