MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5028397cf32d14d61f5015a108f3d13a33f2c5e2cf360b99522bc3f545e3b227. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5028397cf32d14d61f5015a108f3d13a33f2c5e2cf360b99522bc3f545e3b227
SHA3-384 hash: 9347cb1f9bb45f88ceebace8c98c146d25e181a5a265a04aa61b426a71b2305a43caa16b582acc0b04c66af13d82e83a
SHA1 hash: 665cb873e654dd7137982eb00d101b0576d970b7
MD5 hash: 9907d8b07935a0c355f3dbbc398fbdd4
humanhash: carolina-venus-mississippi-london
File name:REQUEST FOR QUOTATION.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:36'224 bytes
First seen:2023-02-09 06:17:47 UTC
Last seen:2023-02-09 07:38:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 768:8fCUhXwRCYd+xubrVS3BxcBsvC7WY7zyiRiHS:M5XY+xsoBxcSC757zyigy
Threatray 1'089 similar samples on MalwareBazaar
TLSH T150F27D2576AC6733E97A57F484D6652647B1B1921402EBAB1CCAA0CF4EE37900711ECF
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter Anonymous
Tags:AgentTesla exe signed

Code Signing Certificate

Organisation:chrome cooperation
Issuer:chrome cooperation
Algorithm:sha256WithRSAEncryption
Valid from:2023-02-07T23:34:09Z
Valid to:2024-02-07T23:34:09Z
Serial number: 6ac8241d18f36c161fa08e38097fad8b
Thumbprint Algorithm:SHA256
Thumbprint: 40cb17c484d82faea26765ab851f249c47635e26e79b08b083c4b1f25c139fc2
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
184
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
luminosity
Create hunting rule
ID:
1
File name:
REQUEST FOR QUOTATION.exe
Verdict:
Malicious activity
Analysis date:
2023-02-09 06:18:26 UTC
Tags:
trojan rat luminosity
Link:
https://app.any.run/tasks/c23ec767-b575-4884-9a6e-8c62ec81b068

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/362537/
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.97377.21394.6465.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Reading critical registry keys
Sending an HTTP GET request
Sending a TCP request to an infection source
Forced shutdown of a system process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/63e4901a459bcf4604ffd29a/reports/3158c292-8518-442c-9ba5-83e82436d48b/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/5028397cf32d14d61f5015a108f3d13a33f2c5e2cf360b99522bc3f545e3b227
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/a8fd61d6-04b9-42c1-bb9c-9ff8ad2a5273
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1169705
Signature
.NET source code references suspicious native API functions
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 802486 Sample: REQUEST FOR QUOTATION.exe Startdate: 09/02/2023 Architecture: WINDOWS Score: 100 38 Snort IDS alert for network traffic 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 6 other signatures 2->44 6 REQUEST FOR QUOTATION.exe 3 2->6         started        11 XdvwAYZ.exe 2 2->11         started        process3 dnsIp4 30 185.17.0.79, 49699, 6666 SUPERSERVERSDATACENTERRU Russian Federation 6->30 26 C:\Users\...\REQUEST FOR QUOTATION.exe.log, CSV 6->26 dropped 46 Writes to foreign memory regions 6->46 48 Injects a PE file into a foreign processes 6->48 13 jsc.exe 17 9 6->13         started        18 SMSvcHost.exe 6->18         started        20 aspnet_compiler.exe 6->20         started        24 27 other processes 6->24 22 conhost.exe 11->22         started        file5 signatures6 process7 dnsIp8 32 api4.ipify.org 104.237.62.211, 443, 49701 WEBNXUS United States 13->32 34 mail.spjsv.ro 89.43.174.45, 26, 49702, 49705 CHROOTBucharestROMANIAEURO Romania 13->34 36 api.ipify.org 13->36 28 C:\Users\user\AppData\Roaming\...\XdvwAYZ.exe, PE32 13->28 dropped 50 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->50 52 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 13->52 54 May check the online IP address of the machine 13->54 56 5 other signatures 13->56 file9 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5028397cf32d14d61f5015a108f3d13a33f2c5e2cf360b99522bc3f545e3b227/
Threat name:
ByteCode-MSIL.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2023-02-08 06:31:30 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
1
AV detection:
14 of 39 (35.90%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kauds7htfuknmh2qcwqqr46rhiz7frpcz43axgksfpb7krpdwitq._file
Verdict:
malicious
Similar samples:
2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168
AgentTesla
28ff484ca36b3a1f5d7f59a25e947e9a6b12ca34214f9bcfca01cee5745e6b6a
AgentTesla
466943db1566f6847124ffe5f218d9639c337bdc4195b6c97ea8e8f579cdc9e6
AgentTesla
658e0f3e03622f2ef3a44be0e3c19d116f9e7445dacc1b6264ea75ed2af25294
AgentTesla
6cfc4dfd10e4a160e8d70e9a8178288daff0ec49e39dd5f45f9ea553b94b4a8f
AgentTesla
8c502620c4b378b6fec3cc2abed90dd0d475d18fa33c34b0a8187e9b00ef13f7
AgentTesla
bba28ca66b05cb8733dd5fe3deaac9f618ddeb2218e349a900501399a70d50a0
AgentTesla
f1ec2da9572ec46cf6937a8e51b0e188f5778d2c6cf47be6fe098a7dc8de87a9
AgentTesla
fb8fdb08cf7984a3bac0cc7daeea3790a92306467543cf556945fc479a165dd8
AgentTesla
+ 1'079 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230209-g2k97afg27/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
5028397cf32d14d61f5015a108f3d13a33f2c5e2cf360b99522bc3f545e3b227
MD5 hash:
9907d8b07935a0c355f3dbbc398fbdd4
SHA1 hash:
665cb873e654dd7137982eb00d101b0576d970b7
Link:
https://www.unpac.me/results/f73cedb2-6bfc-4260-8303-fbe51f353a01/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5028397cf32d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5028397cf32d14d61f5015a108f3d13a33f2c5e2cf360b99522bc3f545e3b227

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 5028397cf32d14d61f5015a108f3d13a33f2c5e2cf360b99522bc3f545e3b227

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/362537/

Comments