MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5522c9cb389b36d40cafd0cb1820934cdf53fe86827677cfe19b7b58d5affce6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 15

Intelligence 15 IOCs YARA 2 File information Comments

SHA256 hash:	5522c9cb389b36d40cafd0cb1820934cdf53fe86827677cfe19b7b58d5affce6
SHA3-384 hash:	4b22b9ca96b47be46109f5db32a54e5bbd1ea940ec341d9f9400e5a72f17f724183b43d4052ae12185a86d7216f2d598
SHA1 hash:	1ed8a053df4194a8fd51215230b7b32a1a52dde7
MD5 hash:	26d77278dadff150551e7d1765abcef3
humanhash:	don-hotel-red-echo
File name:	Docs.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	699'904 bytes
First seen:	2023-05-30 16:52:18 UTC
Last seen:	2023-06-06 14:39:19 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'646 x Formbook, 12'245 x SnakeKeylogger)
ssdeep	12288:OSt2IEiAgn5CQ/HkigckrVid+x2rwySSEbVJ:O6dfBn0Q/HNWidiuwy4J
Threatray	3'243 similar samples on MalwareBazaar
TLSH	T129E4317C9BBA237BA2B7C35447C9B45FB180A573F1057BE5B08203498A25871B5CBD2E
TrID	63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	James_inthe_box
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

281

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Docs.exe

Verdict:

Malicious activity

Analysis date:

2023-05-30 16:53:46 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/12490536-6c77-4d4b-9f79-e6c68374877d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

XorStringsNET

Link:

https://www.capesandbox.com/analysis/393704/

Detection(s):

Sanesecurity.Rogue.0hr.20230530-1733.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Сreating synchronization primitives

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

DNS request

Reading critical registry keys

Sending an HTTP GET request

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/647629eef51ad5d4fcf9aefe/reports/fc771e11-e801-49d3-a8f9-5b35b8d65751/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/5522c9cb389b36d40cafd0cb1820934cdf53fe86827677cfe19b7b58d5affce6

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/985bc672-cfff-42de-a41e-28b248c1ead3

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1245512

Signature

.NET source code contains very large strings

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5522c9cb389b36d40cafd0cb1820934cdf53fe86827677cfe19b7b58d5affce6/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-05-30 15:10:49 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

25 of 37 (67.57%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kurmtszytm3nidfp2dfrqietjtpvh7ugqj3hpt7btn5vrvnp7tta._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

18ed7f360fc5b552348750751a7abf6f5c064c321ac1600a273777e243b0e56c

AgentTesla

19f63d5860ad2cef32b2a159b11de11e844ef0304ff419b40053e6099b34f3a1

AgentTesla

23c10ee1b711e15fde7ee702a195bd4ae3bceed5bfbecb9a3cfaac3ef501d4d0

AgentTesla

285c3ffd2b6cdd180ee0a3371f12f6a0ffb4a77ffc7a811f242749f68722242c

AgentTesla

30272b6380cb51f1ea1c8ba3c294fe504fb80179d4ac31cfa8eb641919137eca

AgentTesla

7ae177e05410a5674d60e619122fda381ca12b03bf136d6cb595a857c2cb51c3

AgentTesla

afee69594c18577546ad73e410935b8ae9a1038d0eed643333037a1cceb06724

AgentTesla

ebfe3afe48dc47239d68700f74f01db8aef2b4c20f833178de5d55988d05a06a

AgentTesla

+ 3'233 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230530-vdy32abb7v/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AgentTesla

Unpacked files

SH256 hash:

a7e17fcf14d55ff0ea177ea38105131dbb6cad90da1d22e24bbd2f33b9367a96

MD5 hash:

2bb5bbc146586605498fde034fbb861a

SHA1 hash:

9f3ebac3375bc1e6a7eb4276a977ac36d2fc3e09

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/f5898db1-6152-4574-92c8-88e4f082fbff/

Parent samples :

64e8bab99d5b2d4f60126625fc49cc873a8b3298a3ea7cb50197b0cbbc47d356
c4412128ec553fc7dd04832d11ccd68c8db5f08729ac401b78fba4c022127625
186fb618cd82863206b3da72960bb3c4dfa9ec3beafb10cc49fabd34f7cda05f
0693896df2ac61be0617616cae39f1d1c9b60c7953b9c45c93fa63d3764a1680
f8d54f533d483b1dd4bca77d1fdbbfe2165c2e63c06f9bb44c2b5c37d384b100
5522c9cb389b36d40cafd0cb1820934cdf53fe86827677cfe19b7b58d5affce6

SH256 hash:

a820e55e3d2d506dae6691661273c740ef17f693654eb1de046c2efe7b42edf4

MD5 hash:

39be4cc27954e4ff7f21e645923f0264

SHA1 hash:

98fb627bcd54dcfb6abfa84c40c63b7e34fd4d84

Link:

https://www.unpac.me/results/f5898db1-6152-4574-92c8-88e4f082fbff/

SH256 hash:

058cf300e35dac4f7a58f48d17ef9dd93d843e6f00698d7039ec5b1a1fd25466

MD5 hash:

3a0327f6950cdd56a642f5ac0506108e

SHA1 hash:

0ee89a6530b77de6dcf93bb18d4618ccaf421d76

Link:

https://www.unpac.me/results/f5898db1-6152-4574-92c8-88e4f082fbff/

SH256 hash:

5522c9cb389b36d40cafd0cb1820934cdf53fe86827677cfe19b7b58d5affce6

MD5 hash:

26d77278dadff150551e7d1765abcef3

SHA1 hash:

1ed8a053df4194a8fd51215230b7b32a1a52dde7

Link:

https://www.unpac.me/results/f5898db1-6152-4574-92c8-88e4f082fbff/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5522c9cb389b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5522c9cb389b36d40cafd0cb1820934cdf53fe86827677cfe19b7b58d5affce6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.