MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52d584d046ff850e6f965ea25018dfb6163cab3fb1d54cc5620b8bb87b2a6fec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 14

Intelligence 14 IOCs YARA 4 File information Comments 1

SHA256 hash:	52d584d046ff850e6f965ea25018dfb6163cab3fb1d54cc5620b8bb87b2a6fec
SHA3-384 hash:	fa2a24137785bc8a640739553ea5999096fb733831f442b2fbee90449fdb6f802f5008deca55bbe90c1c13f159af5739
SHA1 hash:	5f270bd15c22b3453f9f307d1277821d2b7c950d
MD5 hash:	c0e139b4721c1f3203f34732659fbf7e
humanhash:	triple-ceiling-georgia-mexico
File name:	c0e139b4721c1f3203f34732659fbf7e
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	663'040 bytes
First seen:	2023-05-20 21:02:18 UTC
Last seen:	2023-07-11 15:12:06 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	12288:Vhw1gdBzvgSaraHPlFQmemKNG9TAnhtXuVXaeWlqKaJR:Va1gzvgTra0m+1XXiXaFlqX
Threatray	3'963 similar samples on MalwareBazaar
TLSH	T11BE4F1302AD9C71FC02B527984D5D3F017768D94F4B2CA974FDDBC8FB28A2A65322256
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	f8eae6e6e6e6e46a (13 x AgentTesla, 10 x Loki, 7 x Formbook)
Reporter	zbetcheckin
Tags:	32 AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

296

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

Order-P32881.doc

Verdict:

Malicious activity

Analysis date:

2023-05-18 07:47:29 UTC

Tags:

exploit cve-2017-11882 rat agenttesla

Link:

https://app.any.run/tasks/7a633330-5935-4af4-80fc-e8cc7e9056ff

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.67104667.18545.9858.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Creating a file

Using the Windows Management Instrumentation requests

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

comodo formbook packed remcos

Link:

https://www.filescan.io/uploads/64693676ddc05a589d6a3ecc/reports/51fbc54c-5f1b-418f-ba91-6ca8372563da/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/52d584d046ff850e6f965ea25018dfb6163cab3fb1d54cc5620b8bb87b2a6fec

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/1bd71174-24ef-4350-9369-1d85f1ab390b

Result

Threat name:

AgentTesla, zgRAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1238304

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected zgRAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/52d584d046ff850e6f965ea25018dfb6163cab3fb1d54cc5620b8bb87b2a6fec/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-05-18 12:42:12 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 37 (64.86%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=klkyjucg76cq434wl2rfagg7wyldzkz7whkuzrlcbof3q6zkn7wa._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

130af4a0f76145a77e1814efbda5e34f0bb2f0d0a21f189c40fc595c768930fb

AgentTesla

26b70686814f11ee1cfc7490fc25dd5b49553e70f94903a710f7802b6f4ecb78

AgentTesla

71769693e34bd0116c96d55e1ec5f96090d8c1d38f1e037a83effc9de785f52c

AgentTesla

770a7455fc0ac683cf1ea5f64c528ea717871300c1ff20e29cf34276acd0528d

AgentTesla

8a9f60c772d34e86904e09695233a02ae23708dd772f6fb10a754c13073813d1

AgentTesla

bdcbe2ba28e1b1d3830fdd1ec17ff651e864892aacb288dcc21315e7ccba4b0a

AgentTesla

c48ff6e07f88f98649976738a623d755a1718672bc91830a885e8f42e54c4232

AgentTesla

dff610d1e149c13ed0668d4802c1f876650383dc1777db71201c9e7ae57e1197

AgentTesla

ff2e4312ff6513d00f4e3959d47e63bff0be7bf3b3faf53d8491ff9129b1f334

AgentTesla

+ 3'953 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230520-zv1emshc41/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

b0664cff7b9407782ea9f7eb05656d2f90c205e60ed1812a1f524e2b1511a71f

MD5 hash:

6e562e757432f47d0c878732be9177b1

SHA1 hash:

c67e4fe068d7e2ab43d7122892bf1383fc43d3a7

Link:

https://www.unpac.me/results/36cc8db1-f63d-452a-b2bf-960db69997bb/

SH256 hash:

c8f510e80bc685ab5991911bc084ec0c46b21f880fc2046251b456721d29c682

MD5 hash:

866b2494ec252594612b8f2ba642e983

SHA1 hash:

c3915b0c51db916ada9a648fbcb41390cf2b424b

Link:

https://www.unpac.me/results/36cc8db1-f63d-452a-b2bf-960db69997bb/

SH256 hash:

2907ceb0aff33154a49177d6e04e822538f3fb439a55264cdf84b162564afea6

MD5 hash:

ae06e9b9c5d6df3bdb39fbbc75d9b9cd

SHA1 hash:

b03aff7dda4462819b1250e44d80c83aca37237f

Link:

https://www.unpac.me/results/36cc8db1-f63d-452a-b2bf-960db69997bb/

SH256 hash:

16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d

MD5 hash:

fb4ed205b442f470bbf10913128efdcb

SHA1 hash:

9a0a4c5ae429769e3253a9a3daefa24270b87a5b

Link:

https://www.unpac.me/results/36cc8db1-f63d-452a-b2bf-960db69997bb/

Parent samples :

ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e

SH256 hash:

71769693e34bd0116c96d55e1ec5f96090d8c1d38f1e037a83effc9de785f52c

MD5 hash:

f52ca7ec12ee4c905fd0c8888707076d

SHA1 hash:

05a60c21dc8ada56b848dbf8487cf371a0d2cabd

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/36cc8db1-f63d-452a-b2bf-960db69997bb/

Parent samples :

e6e90d14d8ae1df119d47eb1d5550d5f0eef77323dc95e576e3980a53e2555a3
1550a435aba0cb055a5412c79c4b3e659763f7eb78a8984e6471212b11c57d14
dc9592028314f25ba440ef8629468e39714188cdd0d681e76d2e8222bec8978c
bdcbe2ba28e1b1d3830fdd1ec17ff651e864892aacb288dcc21315e7ccba4b0a
e98bd4ed05c5d8f05861357156e67cf2eb1ece78e082e39abc9db81be3a408b5
d4aacef823ff0e408cc83eabb90157bae1171f133b387e1e2ec389842676cb3c
d649478667e016eb85bb4ef8cb5c96531547744fb444b1ee85bf6c0e4b3dcae2
ac79243f3e4c0ed820af9da511c8736fa82b71522ef90e0dd6baab1810160c1b
e04268f6e6265c7ad7f9c6f5e4edecce0cd7e3e399d096c288ab6089ab552734
fd0d5e94af637a6270fb09d1b157119c4e5b339cbd9f7f971ed08733985739f3
6ca31b46672e94e599a307894e5ff6d5e946b12a74e1270f54e0f12b7a37bdba
d94ff3cae0cda84338cd5a45ba92639c5e824a77a8de9f4e77a69b9307f3e69d
52d584d046ff850e6f965ea25018dfb6163cab3fb1d54cc5620b8bb87b2a6fec
634d85d5b533562ab4f53b5777a2b228067d400ed6a4151184d8b5b8c6dce151
9b39bf0f30b27ec3b6f017156cd1ad3b2ad08868392d9ecf3f9e01934cc8d0fd
4b0f3dd16fcd416c9cdcd55e292a5a04ee6c1114e99935118f375f10ec48b5bf

SH256 hash:

52d584d046ff850e6f965ea25018dfb6163cab3fb1d54cc5620b8bb87b2a6fec

MD5 hash:

c0e139b4721c1f3203f34732659fbf7e

SHA1 hash:

5f270bd15c22b3453f9f307d1277821d2b7c950d

Link:

https://www.unpac.me/results/36cc8db1-f63d-452a-b2bf-960db69997bb/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/52d584d046ff/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/52d584d046ff850e6f965ea25018dfb6163cab3fb1d54cc5620b8bb87b2a6fec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MSIL_SUSP_OBFUSC_XorStringsNet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:	https://github.com/dr4k0nia/yara-rules

Rule name:	msil_susp_obf_xorstringsnet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

exe 52d584d046ff850e6f965ea25018dfb6163cab3fb1d54cc5620b8bb87b2a6fec

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2637677/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-05-20 21:02:24 UTC

url : hxxp://171.22.30.164/damianozx.exe