MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56cb155038e669d3008542380999cc6679800ece2b258cab31ff838e6df4415e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56cb155038e669d3008542380999cc6679800ece2b258cab31ff838e6df4415e
SHA3-384 hash: 13cc25c15ca4c51e40bcdf6b6cf927a596bb83d4e89e8f9ac564e9076064c1b4ed5d9328b4695dbda4e5a7ac68dedd64
SHA1 hash: 225eec95b051901e22f1e2d1ae1988f344f2f783
MD5 hash: 53c2ba0311f945d286e6d1a78c55cfac
humanhash: romeo-sierra-bacon-finch
File name:order.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:628'736 bytes
First seen:2023-10-12 06:58:47 UTC
Last seen:2023-10-13 07:44:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:P/CvoY2uHXcWX+4W8Yl8ry5/oMV4ItgDHp+E6bBE7Lkfy:P/CvoFuHXI4jYl8ry5AMVvSHwEWEXkfy
Threatray 421 similar samples on MalwareBazaar
TLSH T1D0D42351F0882A1BC6DB47FF8C51A5661AF5223625A9E6CCCCD530DDF987B90A0C1EB3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 04c0e0ecc8c4c408 (9 x AgentTesla, 2 x Loki, 2 x Formbook)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
315
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
order.exe
Verdict:
Suspicious activity
Analysis date:
2023-10-12 07:02:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9066275f-10cf-4276-a814-639a5ee1f273

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/453689/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/65279938853e4f06480a63df/reports/387abbc0-dcc3-4346-86a6-5899a3b52143/overview
Verdict:
Malicious
Labled as:
MSIL/GenKryptik_AGeneric.QZ trojan
Link:
https://www.hybrid-analysis.com/sample/56cb155038e669d3008542380999cc6679800ece2b258cab31ff838e6df4415e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f7840ba8-2874-47d2-9cb8-360180b18059
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1324446
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Contains functionality to log keystrokes (.Net Source)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/56cb155038e669d3008542380999cc6679800ece2b258cab31ff838e6df4415e/
Threat name:
ByteCode-MSIL.Spyware.Genkryptikagen
Create hunting rule
Status:
Malicious
First seen:
2023-10-12 06:59:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
16 of 24 (66.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k3frkuby4zu5gaefii4atgommz4yadwofmsyzkzr76by43puifpa._file
Verdict:
malicious
Similar samples:
02c0f5222dc54b1b573ef1c02a392299d4e2066ca12e9b34de3d6d4f0dad909f
AgentTesla
4979d51c93d480bc32b1de7fe0d366d0a6fc93301e46ad4dd8a2089d26e57065
AgentTesla
7316b0e5c95d1ff17274693f4681e7920d6305079d5833c96acf54d724852651
AgentTesla
79d976cea79bce9e0f920d918af0f1b0721266ca091633ae37811e088b04d1ec
AgentTesla
d0475c384cd4d7b6ea2c3460a07c49fd59aafe87841e479d7965c3384ccec67d
AgentTesla
ddb4b8244d94be167ef9365d5b2c87a55a466300a20cb2ae7097c9fd99799f9f
AgentTesla
fb88365884043fb264c0bb3d9291a58cfd5955468f35bfe77154b316981bdaa6
AgentTesla
febd8601144ffe589e545c704e0734c6df24df1f9570e842c00bf3d5a7ce72d5
AgentTesla
+ 411 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/231012-hr3xxsch3y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
b1270dc9ec3f22c6fd2296239426ac7c48589589580d4a1b3da8188920b22a63
MD5 hash:
5c904da8528cfb1b87b15a6aa7c059cd
SHA1 hash:
f0a192969485d1bc34bf52adf37d9c20176d6b85
Link:
https://www.unpac.me/results/78a6c996-c73b-4e62-99d8-ee544e5d9fd9/
SH256 hash:
ffabc13f7fad5bea21ab9b04b5c04700394db8ec812f01af098dfbd213b0cded
MD5 hash:
bb95d7e54d7271723c25cf89f5bc63fc
SHA1 hash:
c00a879d8c2bf1d1600387eee96b70f53fa53a39
Link:
https://www.unpac.me/results/78a6c996-c73b-4e62-99d8-ee544e5d9fd9/
SH256 hash:
1306386cf9a8ba840e262ca5ff24c83604545abf9bf34a701513c84f721cb137
MD5 hash:
16ef4a7bfafce43e0b47ef40b19d595b
SHA1 hash:
859624f5c9565275336f3236819d4de412612405
Link:
https://www.unpac.me/results/78a6c996-c73b-4e62-99d8-ee544e5d9fd9/
SH256 hash:
8d6dcd023b1d98d5a7949bf9594c9f46054e4157e2d1d4605b9a03c8e1a91e02
MD5 hash:
dea976adc933d305ca1966dbd6f2b6e2
SHA1 hash:
14a8d72313065cea4e945c968b2f9a91951db7b0
Detections:
AgentTesla
Create hunting rule
win_agent_tesla_g2
Create hunting rule
Link:
https://www.unpac.me/results/78a6c996-c73b-4e62-99d8-ee544e5d9fd9/
Parent samples :
79d976cea79bce9e0f920d918af0f1b0721266ca091633ae37811e088b04d1ec
fb88365884043fb264c0bb3d9291a58cfd5955468f35bfe77154b316981bdaa6
56cb155038e669d3008542380999cc6679800ece2b258cab31ff838e6df4415e
ca528eb30885238a7e594075c68afe244602e2438da103c98ddd81cbdeaffa2e
b7d6a1034526c45dcdd4f88061de0b13047d330a97ed1d5466d7717190db8ccd
SH256 hash:
56cb155038e669d3008542380999cc6679800ece2b258cab31ff838e6df4415e
MD5 hash:
53c2ba0311f945d286e6d1a78c55cfac
SHA1 hash:
225eec95b051901e22f1e2d1ae1988f344f2f783
Link:
https://www.unpac.me/results/78a6c996-c73b-4e62-99d8-ee544e5d9fd9/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/56cb155038e6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 56cb155038e669d3008542380999cc6679800ece2b258cab31ff838e6df4415e

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/453689/

Comments