MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5700f9cb1f8277f84653a6ed9307eade654262cc37a141cc0c1cff1fb1096e8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5700f9cb1f8277f84653a6ed9307eade654262cc37a141cc0c1cff1fb1096e8e
SHA3-384 hash: c087c1aac110467bde9271beae8b5aa1ab76d27559e14f497a4b2ba0a52852cad8bd9968a351422f3e8db96e7c086264
SHA1 hash: 2b632728b725320e35bcd329ea33acef9eb38a82
MD5 hash: 3a7e5b56f57e9a8ba689ae95b58beea5
humanhash: lemon-zebra-montana-oscar
File name:MV.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:905'728 bytes
First seen:2021-04-05 06:30:53 UTC
Last seen:2021-04-05 08:54:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:HsRkQoo5h0d9Z+biJm8o5hFJVzw9UPeiELJs95EK:HxxZjanzw92pE
Threatray 3'770 similar samples on MalwareBazaar
TLSH DB15D02B3B61D954C11C0D3A441B92DC83FA5A0B79D2F79F70EE2B8D1F202B6975B489
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vynass.com
Sending IP: 80.82.67.81
From: Operations@vynass.com
Reply-To: Ryan Daniels <Operations.vynass@mail.com>
Subject: MV New Courage
Attachment: MV NEW COURAGE.7z (contains "MV.exe")

Intelligence

File Origin
# of uploads :
3
# of downloads :
194
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
MV.exe
Verdict:
Malicious activity
Analysis date:
2021-04-05 06:36:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8fe13632-0b22-44e1-be92-f2156515e810

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/132154/
Detection(s):
SecuriteInfo.com.Artemis3A7E5B56F57E.28821.26103.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Creating a window
Running batch commands
Launching a process
Sending a UDP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Unauthorized injection to a recently created process
Enabling autorun
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d7b3fd8a-c162-4314-b30b-0bb958786f87
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/665815
Signature
.NET source code contains very large array initializations
Creates an undocumented autostart registry key
Drops PE files to the startup folder
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 381833 Sample: MV.exe Startdate: 05/04/2021 Architecture: WINDOWS Score: 96 39 Found malware configuration 2->39 41 Multi AV Scanner detection for dropped file 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 2 other signatures 2->45 7 MV.exe 15 7 2->7         started        11 Evilspirit.exe 5 2->11         started        process3 file4 27 C:\Users\user\AppData\...vilspirit.exe, PE32 7->27 dropped 29 C:\Users\user\AppData\...\InstallUtil.exe, PE32 7->29 dropped 31 C:\Users\...vilspirit.exe:Zone.Identifier, ASCII 7->31 dropped 33 C:\Users\user\AppData\Local\...\MV.exe.log, ASCII 7->33 dropped 49 Drops PE files to the startup folder 7->49 51 Hides that the sample has been downloaded from the Internet (zone.identifier) 7->51 13 cmd.exe 1 7->13         started        15 Evilspirit.exe 14 3 7->15         started        35 C:\Users\user\AppData\Local\...\vessels.exe, PE32 11->35 dropped 53 Writes to foreign memory regions 11->53 55 Injects a PE file into a foreign processes 11->55 17 vessels.exe 11->17         started        20 InstallUtil.exe 11->20         started        signatures5 process6 signatures7 22 reg.exe 1 1 13->22         started        25 conhost.exe 13->25         started        37 Multi AV Scanner detection for dropped file 17->37 process8 signatures9 47 Creates an undocumented autostart registry key 22->47
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5700f9cb1f8277f84653a6ed9307eade654262cc37a141cc0c1cff1fb1096e8e/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-04-05 04:34:02 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k4aptsy7qj37qrstu3wzgb7k3zsueywmg6qudtamdt7r7mijn2ha._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0e360afe7e5de25783afb92588b7c54eee9413d21727c9379f813db1501c8ce3
AgentTesla
1974eb0632e98cc3277adaa0074d95fe33602c751a27032d93ae03b09dd9e77d
AgentTesla
233e814f54f8fa50dde3e233107cc7d2dbf72b6a02c10ca1299170321f143bd4
AgentTesla
826298b4d035818be292a13b27215db4d94733f28df50f94e9a93a5d3fea2190
AgentTesla
a69c7080e11bb7bb263502047a550d725500b2a49a0f09d965b1586b7437572f
AgentTesla
a717f13ed10b05c55dea1f2551da0f2d2fb2e49cd153da93be3fdd618c5cee6a
AgentTesla
a8acff53e54f7454fd6dec6954f1505ec159f549f878a79f35d4cd5f512c09fd
AgentTesla
b5a2fbfeb80e2e92039a23615df8b8f63f42d1331528f514b312d4946dc22607
AgentTesla
d9cedebf76480c48b17ab650c102473a80ec6a9525ef0ae2f827ef567f914aff
AgentTesla
d9da943369eeaa00a7eb98b6a0033ddf4d0f1c9661bb179697b2ab653e87eb3f
AgentTesla
+ 3'760 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla agilenet keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210405-2cgpr9fr6j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Drops startup file
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Executes dropped EXE
AgentTesla Payload
AgentTesla
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
5700f9cb1f8277f84653a6ed9307eade654262cc37a141cc0c1cff1fb1096e8e
MD5 hash:
3a7e5b56f57e9a8ba689ae95b58beea5
SHA1 hash:
2b632728b725320e35bcd329ea33acef9eb38a82
Link:
https://www.unpac.me/results/36a96e3c-4487-4292-a44a-f5b375e427a9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/5700f9cb1f8277f84653a6ed9307eade654262cc37a141cc0c1cff1fb1096e8e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z af12302722b823290bbe03f069d0ec0c14b77691e80e1a917d87096e8b18381a

AgentTesla

Executable exe 5700f9cb1f8277f84653a6ed9307eade654262cc37a141cc0c1cff1fb1096e8e

(this sample)

  
Dropped by
MD5 99f09d69fb6251104190825e0af635b0
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 af12302722b823290bbe03f069d0ec0c14b77691e80e1a917d87096e8b18381a
Cape
Cape
https://www.capesandbox.com/analysis/132154/

Comments