MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57979ca3e646ecfcf45221a35642d69c66d753e9961468e65e66670c4f7513a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 57979ca3e646ecfcf45221a35642d69c66d753e9961468e65e66670c4f7513a6
SHA3-384 hash: 1b6d1468e220e8b833635e5447d2ef9d991dccea7b8c67e1ccd96cd31296a8d83f695fb598f2b99089106a78887bf7c7
SHA1 hash: f7700360e01f5f7c04d03a55bf44e710a232f57a
MD5 hash: 85e87648fb92a7aa586acf2816cf1de4
humanhash: freddie-lion-april-tennis
File name:ENQUIRY.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:874'496 bytes
First seen:2023-05-10 06:05:21 UTC
Last seen:2023-05-10 10:14:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:oYGadqZfOtXyuFMUwSTBJLb4dgFU1nxKn7+O8TzesIBhm3kg3/TerwXqOIlPd:o52IqXdMSlJQMUnxKn0RIBhB0yrmq9D
Threatray 1'002 similar samples on MalwareBazaar
TLSH T1EE058C3D21DA5C26C71673FA8959C5E103356F00AEABD16A26BE30CC8D71BA3ED8154F
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9d9e1969696b0646 (9 x SnakeKeylogger, 8 x AgentTesla, 4 x Loki)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
243
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ENQUIRY.exe
Verdict:
Malicious activity
Analysis date:
2023-05-10 06:07:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7ac6b9bd-ad05-45f7-9bb2-02072ae6dfd6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/388014/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/645b344d8399e8849cbcba2a/reports/6191eee5-d6aa-4924-a501-988fcd49128c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/57979ca3e646ecfcf45221a35642d69c66d753e9961468e65e66670c4f7513a6
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fc45fc15-1cd5-4b73-81fc-0b01014e2dd0
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1229740
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Adds a directory exclusion to Windows Defender
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 862722 Sample: ENQUIRY.exe Startdate: 10/05/2023 Architecture: WINDOWS Score: 100 46 Snort IDS alert for network traffic 2->46 48 Found malware configuration 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 8 other signatures 2->52 7 ENQUIRY.exe 7 2->7         started        12 PYqCxc.exe 5 2->12         started        process3 dnsIp4 42 192.168.2.1 unknown unknown 7->42 34 C:\Users\user\AppData\Roaming\PYqCxc.exe, PE32 7->34 dropped 36 C:\Users\user\...\PYqCxc.exe:Zone.Identifier, ASCII 7->36 dropped 38 C:\Users\user\AppData\Local\...\tmpF4DE.tmp, XML 7->38 dropped 40 C:\Users\user\AppData\...NQUIRY.exe.log, ASCII 7->40 dropped 54 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->54 56 Uses schtasks.exe or at.exe to add and modify task schedules 7->56 58 Adds a directory exclusion to Windows Defender 7->58 14 ENQUIRY.exe 2 7->14         started        18 powershell.exe 19 7->18         started        20 schtasks.exe 1 7->20         started        22 ENQUIRY.exe 7->22         started        60 Multi AV Scanner detection for dropped file 12->60 62 Machine Learning detection for dropped file 12->62 64 Injects a PE file into a foreign processes 12->64 24 PYqCxc.exe 2 12->24         started        26 schtasks.exe 1 12->26         started        file5 signatures6 process7 dnsIp8 44 modelinfra.com 159.89.168.198, 49695, 49697, 587 DIGITALOCEAN-ASNUS United States 14->44 28 conhost.exe 18->28         started        30 conhost.exe 20->30         started        66 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 24->66 68 Tries to steal Mail credentials (via file / registry access) 24->68 70 Tries to harvest and steal browser information (history, passwords, etc) 24->70 32 conhost.exe 26->32         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/57979ca3e646ecfcf45221a35642d69c66d753e9961468e65e66670c4f7513a6/
Threat name:
Win32.Trojan.RemLoader
Create hunting rule
Status:
Malicious
First seen:
2023-05-10 03:37:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
33
AV detection:
21 of 37 (56.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k6lzzi7gi3wpz5csegrvmqwwtrtnou7jsykgrzs6mztqyt3vcota._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
108ad52223146f11df1f746b5b2fa805905c183d0fab1ed35cabaa0226df91de
AgentTesla
392ee3c9d47409b170b5e4d6f7eedf427bf1121be42b024a663340bed3025bd4
AgentTesla
3b0acc239747010ba9c56cf22b4ace536d82bf3748dfb14e8b977c07f8dc976d
AgentTesla
57ff6de510ccaa060efa53e2c9e1c1b8c3b132fa55289a8a7ecc321a5370043a
AgentTesla
a3e624899642025593a5646ecff5cbdf946e5b13debcdf57aad589d4da03de3a
AgentTesla
a782d89a06f36333a3e7370c6b535d5dfb518edfed64e660d989de3b53b207fa
AgentTesla
ce951f9946a66af4cf461317865d760231a083710a35ae4d2ff362201ec66966
AgentTesla
d46e1ec4fd88c836e0f27060808c2506e0df5d1034f9c88e56dd37bfc2113120
AgentTesla
fa06c367eea3dc7496e8b8c3baf34ed7775518d1b779d041f41b0a4b92d4a922
AgentTesla
+ 992 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230510-gtq6gagd7t/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
3ab1dcc37e7c5c643bf41e9f0f81f816f24974fbddde95e2af52426e3374dd35
MD5 hash:
8a2c496875c0871aecc16aae768b323f
SHA1 hash:
f5423a32125c70b512de301c5616c7b75477e2e7
Link:
https://www.unpac.me/results/daf2eaa9-8c66-489a-ac3e-f98a44e08034/
SH256 hash:
39c213a07e551ad3446616f7f4a17612dc74c813e7cb74d10d559ec31ea1e393
MD5 hash:
38eddf3d406e016153036d9679f1f722
SHA1 hash:
6c6bec9a32a58d749a0e460a18f399a2ad0d308c
Link:
https://www.unpac.me/results/daf2eaa9-8c66-489a-ac3e-f98a44e08034/
SH256 hash:
bd6288a183af76fbfb9696d48bea2f7c2e7768179180e69ebd1370c75f397dd2
MD5 hash:
31dbd4665fd17746421a596b3088c2a6
SHA1 hash:
64249c0b74f6fe0ff6177f8686543b3f9a9d88a3
Link:
https://www.unpac.me/results/daf2eaa9-8c66-489a-ac3e-f98a44e08034/
SH256 hash:
7d10e45f6b8ee7ea8b73d06a8e901d037b3abd00dd97b56ee787b895f0a8f62e
MD5 hash:
6011f170f398fa69f5d2e7717b1918f5
SHA1 hash:
6198c08da128af41badab2c9069c9b8150f70efc
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/daf2eaa9-8c66-489a-ac3e-f98a44e08034/
Parent samples :
c4478ee4d7e4a2c94c2ab27ed4bf7e6ae88e88a218c5d6adce8cd8911d0977bc
b3cd2c1c4175d167fed9aa6ddf4d0d6fd1a1a97e0192c4896e500bb7d4cfed99
3d769495075d2080a7dfd8f017f6cdcb403cfce9df8fdd92aecdc98fae45deb9
02fa0fa7b89d8ad41c32e0613ef1bb1c38d9b93ea98d9295b7d61c2ca400a300
866e30140fc553f94493a28cae2b615924240cba323fd08f95ee0c716f28ee0e
494979f4e2eca84b240d774c80ad703ada9db1f3314d6431bdb6228045c7e2b5
a782d89a06f36333a3e7370c6b535d5dfb518edfed64e660d989de3b53b207fa
57979ca3e646ecfcf45221a35642d69c66d753e9961468e65e66670c4f7513a6
0c0de658cc1409dddb75bd3149de4f0bfa90b74296d8d1cb909e3189f8ed2260
SH256 hash:
d8fc5dfdf2800247eb610beb076fec4d2becf6d951e89445d43237fe97814218
MD5 hash:
e5d93dadd08b8bc727e4f4853c6881ba
SHA1 hash:
27e0e057d33f01586193b0cbf06561c2863951f4
Link:
https://www.unpac.me/results/daf2eaa9-8c66-489a-ac3e-f98a44e08034/
SH256 hash:
57979ca3e646ecfcf45221a35642d69c66d753e9961468e65e66670c4f7513a6
MD5 hash:
85e87648fb92a7aa586acf2816cf1de4
SHA1 hash:
f7700360e01f5f7c04d03a55bf44e710a232f57a
Link:
https://www.unpac.me/results/daf2eaa9-8c66-489a-ac3e-f98a44e08034/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/57979ca3e646/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/57979ca3e646ecfcf45221a35642d69c66d753e9961468e65e66670c4f7513a6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:msil_susp_obf_xorstringsnet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip db2e09e48807ff6a8b66fb3fcf0b8cccbda4b391482b78fed49fbf2ef296efae

AgentTesla

Executable exe 57979ca3e646ecfcf45221a35642d69c66d753e9961468e65e66670c4f7513a6

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/388014/
  
Dropped by
SHA256 db2e09e48807ff6a8b66fb3fcf0b8cccbda4b391482b78fed49fbf2ef296efae
  
Dropped by
MD5 084bdc8e985d71869c6f1c5ab29574fd

Comments