MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b66c3a00ac37171118bfa8da7954f64ee34f022cf062fb964ef4a1bcf363ca8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b66c3a00ac37171118bfa8da7954f64ee34f022cf062fb964ef4a1bcf363ca8
SHA3-384 hash: 42ff6a2bdee95b92e7bac94e2cb7637ca66c473d03dc3b22c956ba3be7a3ea12936890a4fda70e61fe9ab676d6378118
SHA1 hash: 4cd769eb9d80710c64e1d09fad9f4ecae1bc9c60
MD5 hash: 26780500725c381d93baf3ab8629d2cc
humanhash: nebraska-white-grey-quiet
File name:DOCUMENT_MAIL_MK77123.PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'039'872 bytes
First seen:2023-06-21 12:58:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:5g7U8dvDcAwViSCLoAPdF4Gh0me9LfsuZ/a70GDs:67U8dvQRVqL7E20me9LfsuB60Os
Threatray 3'137 similar samples on MalwareBazaar
TLSH T13725E0A03B7D1B55F8BEA3F5893156B603B07D2E246DD25D2C82B0EF0971B424912F6B
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0c9c8ad0969ae2e6 (4 x AgentTesla, 1 x BlackShades, 1 x BlackGuard)
Reporter malwarelabnet
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
292
Origin country :
CA CA
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DOCUMENT_MAIL_MK77123.PDF.exe
Verdict:
Malicious activity
Analysis date:
2023-06-21 13:00:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bd733472-1bfe-487b-b50a-2093c99e45ee

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XorStringsNET
Create hunting rule
Link:
https://www.capesandbox.com/analysis/401358/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2126.22372.969.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm greyware masquerade packed
Link:
https://www.filescan.io/uploads/6492f41a99f0c0cb093339b6/reports/a56ca43f-1e08-4250-98d8-1e484af6188b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/5b66c3a00ac37171118bfa8da7954f64ee34f022cf062fb964ef4a1bcf363ca8
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/df2717a8-3d5e-429e-a1d6-df0ebbe172d6
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1259015
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected Telegram RAT
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 892035 Sample: DOCUMENT_MAIL_MK77123.PDF.exe Startdate: 21/06/2023 Architecture: WINDOWS Score: 100 51 Snort IDS alert for network traffic 2->51 53 Found malware configuration 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 11 other signatures 2->57 7 DOCUMENT_MAIL_MK77123.PDF.exe 7 2->7         started        11 YOogtpdypmTdju.exe 5 2->11         started        process3 file4 35 C:\Users\user\AppData\...\YOogtpdypmTdju.exe, PE32 7->35 dropped 37 C:\...\YOogtpdypmTdju.exe:Zone.Identifier, ASCII 7->37 dropped 39 C:\Users\user\AppData\Local\...\tmp431B.tmp, XML 7->39 dropped 41 C:\...\DOCUMENT_MAIL_MK77123.PDF.exe.log, ASCII 7->41 dropped 59 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->59 61 May check the online IP address of the machine 7->61 63 Uses schtasks.exe or at.exe to add and modify task schedules 7->63 69 2 other signatures 7->69 13 DOCUMENT_MAIL_MK77123.PDF.exe 15 7 7->13         started        17 powershell.exe 21 7->17         started        19 schtasks.exe 1 7->19         started        65 Multi AV Scanner detection for dropped file 11->65 67 Machine Learning detection for dropped file 11->67 21 YOogtpdypmTdju.exe 11->21         started        23 schtasks.exe 1 11->23         started        25 YOogtpdypmTdju.exe 11->25         started        27 YOogtpdypmTdju.exe 11->27         started        signatures5 process6 dnsIp7 43 api4.ipify.org 64.185.227.155, 443, 49692, 49695 WEBNXUS United States 13->43 45 api.telegram.org 149.154.167.220, 443, 49693, 49694 TELEGRAMRU United Kingdom 13->45 49 2 other IPs or domains 13->49 71 Installs a global keyboard hook 13->71 29 conhost.exe 17->29         started        31 conhost.exe 19->31         started        47 api.ipify.org 21->47 73 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 21->73 75 Tries to steal Mail credentials (via file / registry access) 21->75 77 Tries to harvest and steal browser information (history, passwords, etc) 21->77 33 conhost.exe 23->33         started        signatures8 79 May check the online IP address of the machine 47->79 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5b66c3a00ac37171118bfa8da7954f64ee34f022cf062fb964ef4a1bcf363ca8/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-06-21 04:25:56 UTC
File Type:
PE (.Net Exe)
Extracted files:
48
AV detection:
17 of 24 (70.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lntmhiakynyxceml7kg2pfkpmtxdj4bcz4dc7ole55fbxtzwhsua._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0a50e4e96fe3948c570214cd5dcdf34b3a2625742eaf15ebdde41d0cd75dea61
AgentTesla
423562e381586b1c4169d9c3c00014ef14c69bc546897a47ad7a301ac6c7c3c1
AgentTesla
5206fb34c3360635f7a152e0f3f336dafbca03f1e3d2bb957b8cb9adc726240e
AgentTesla
5ed11a0df9fba27a5396e764f91ffdef4cc12784303f8d48bd1090528df306de
AgentTesla
7c588579baa7695841603d6d5b2cbd0ae9af1ff49be00df6a44bc180b58beb6f
AgentTesla
8aa6646e0d7997fc15f5b67cfddb0aef3d1ca580c5dabf0396e6c62fa666ec70
AgentTesla
9197cc85a9c5fc3d9463da236c1c96551a0e805bdfd2d3c133a479f9b2ae6d0a
AgentTesla
b4deb5c9d4417c4cc42bdb2c388f6c0552115e6df80b86e680a4aa08a3c0df15
AgentTesla
c1b407328dfb3df00e409a9c3661b8ed81aea549322104e30929f1d669404d06
AgentTesla
+ 3'127 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230621-p724wshe57/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot6261426177:AAGKVvStJVx3AbPod6gVs0gLfIFG75EuCzc/
Unpacked files
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/56006fb8-dc7a-4856-a30b-96f8a6dba3ec/
SH256 hash:
26fb4bbebece5f4d035babb3c568d3a732dc127fea26ed9fa746b73a348fb5cf
MD5 hash:
56f9579697b86feb11b59bd01f2d6454
SHA1 hash:
8ee16bd417c9458d992052f02f86a9031ece33c2
Link:
https://www.unpac.me/results/56006fb8-dc7a-4856-a30b-96f8a6dba3ec/
SH256 hash:
fcd9a285076c520c73421fa9b0456c06cdbb3c087481f167e6bd5b18555dc191
MD5 hash:
bc1c82571e046deac0795f832966fda6
SHA1 hash:
76a5bf8577374c9e61abc76f4ba88ee044580525
Link:
https://www.unpac.me/results/56006fb8-dc7a-4856-a30b-96f8a6dba3ec/
SH256 hash:
fa03ae6a195b05e390e9c3843ede75c4d8dab37ce7aae0ab5af3f7f0efb90df1
MD5 hash:
49d2777904eada915f9754801e7f69a3
SHA1 hash:
58d07640f4dfe5e20df54fc41cdb224190fc11dd
Link:
https://www.unpac.me/results/56006fb8-dc7a-4856-a30b-96f8a6dba3ec/
SH256 hash:
bf913d26b24a9dad9066fb4f3bee9777e80994cda6eca323c87b594d2ea87d8a
MD5 hash:
fbf753ebc1d632cfde9e6b12ce952189
SHA1 hash:
38fc82bd891db720ff6368d4c59175d039dedb1b
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/56006fb8-dc7a-4856-a30b-96f8a6dba3ec/
SH256 hash:
5b66c3a00ac37171118bfa8da7954f64ee34f022cf062fb964ef4a1bcf363ca8
MD5 hash:
26780500725c381d93baf3ab8629d2cc
SHA1 hash:
4cd769eb9d80710c64e1d09fad9f4ecae1bc9c60
Link:
https://www.unpac.me/results/56006fb8-dc7a-4856-a30b-96f8a6dba3ec/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5b66c3a00ac3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5b66c3a00ac37171118bfa8da7954f64ee34f022cf062fb964ef4a1bcf363ca8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:msil_susp_obf_xorstringsnet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/401358/

Comments