MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5baccdcd2956925b6280da41dbd94b190336e599b5f6f4bd1a1ed3d7ba9ca94a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5baccdcd2956925b6280da41dbd94b190336e599b5f6f4bd1a1ed3d7ba9ca94a
SHA3-384 hash: ead9f98193e1c670caa5bb5a16cc74231b2f6c1730ede5f945e02afa7c6ce465eae7ff3ffc3ad4c64034758ab74e912e
SHA1 hash: 051b616366ae1b263cf3e4ce96bc07004469b383
MD5 hash: e837ba78eda076c383676dfdb9846d36
humanhash: failed-cold-fifteen-sierra
File name:TNT shipments.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:753'664 bytes
First seen:2021-10-11 10:17:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:plkF+8T4iqLF5IDe5JX5VMm3hdCze1wiNYyAwdHh5rLiJgl2Kv:ph8TOF5IDe5Jp73Wzu6
Threatray 11'321 similar samples on MalwareBazaar
TLSH T158F4B459F342AC0ED457557354E459E3A1042CC7E8498339EBB3BAA358AE3814F4CBEE
Reporter abuse_ch
Tags:AgentTesla exe TNT

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
TNT shipments.exe
Verdict:
Suspicious activity
Analysis date:
2021-10-11 10:24:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/aba979ac-f32f-45e3-aee9-34acc35310a2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/196573/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.20279.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Launching a process
Creating a file in the %temp% directory
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61640f5d1c2d58ba74019e0c/reports/6a93ae6f-e360-4f31-b244-ab991bfcc24c/overview
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/867990
Signature
.NET source code contains very large array initializations
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 500420 Sample: TNT shipments.exe Startdate: 12/10/2021 Architecture: WINDOWS Score: 96 20 Found malware configuration 2->20 22 Multi AV Scanner detection for submitted file 2->22 24 Yara detected AgentTesla 2->24 26 4 other signatures 2->26 7 TNT shipments.exe 3 2->7         started        process3 file4 16 C:\Users\user\...\TNT shipments.exe.log, ASCII 7->16 dropped 28 Injects a PE file into a foreign processes 7->28 11 TNT shipments.exe 2 7->11         started        signatures5 process6 process7 13 dw20.exe 22 6 11->13         started        dnsIp8 18 192.168.2.1 unknown unknown 13->18
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5baccdcd2956925b6280da41dbd94b190336e599b5f6f4bd1a1ed3d7ba9ca94a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-10-11 10:18:11 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lowm3tjjk2jfwyua3ja5xwkldebtnzmzwx3pjpi2d3j5pou4vffa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
303cf0969720059305f095045e89ecb76c87f0b7473723ea9c09e534a99f1e21
AgentTesla
4a9f65c36f2f23acdba1e9d4aa7ac525822441e2a7ae14afcf8808dc86f0405c
AgentTesla
5a3fa956c8c6f4c56393717e712e7ce7a9876274388257361b4ce4196c190330
AgentTesla
6f0cff53c11bebf24450104782085a6ef18dc93011df4db7ec03e78f9ed6ee14
AgentTesla
8160d7520a2f9630dc0b3773b07d2a9fdf937f2b3b722980c96dfbc4db4a85a7
AgentTesla
8b9abfcdfed4c5a95b6425c5ca75d7b0a17e43e42d6f78cca6f7d8e8c2d7a967
AgentTesla
8f75c88c3376308b7053698d849a6f228cd9ebde1fec893fa850d4fa9e9ac25a
AgentTesla
ae8f0cb0a3ed88eab8f8867cacc01ca2937be743bd1c75940eac053a8a4dd42f
AgentTesla
b73af6301fd4b0efff09e43dac97b8abf2e3d8d8eec3bee435002e320eaedf5f
AgentTesla
b8a9e94c8bbe43c7684e509ae89eb4d74b28a7fb3d5504c559f555c1e453bdd7
AgentTesla
+ 11'311 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/211011-mbyqgsggg3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
eab2bfb0d7595239f7ee0d019ffb255735f8f125bd67a37d0426ca26c4823e86
MD5 hash:
750f3b078fa53ccde72eff1e4142975e
SHA1 hash:
eca5efe68a55fe72d0420cb2654c8a9b8fa4d229
Link:
https://www.unpac.me/results/f03c2ff0-52ef-45e1-881e-d8c9aa6d2058/
SH256 hash:
4865446841a6133cbba36d28d5f63d98ab58605e696de8aa27b934d49708df1f
MD5 hash:
2359144df9e32a2b2c7128d8ad48b680
SHA1 hash:
a5ad41e97aea2e0986a773ffda916be2f1b5f8cf
Link:
https://www.unpac.me/results/f03c2ff0-52ef-45e1-881e-d8c9aa6d2058/
SH256 hash:
43e38f251dbca9aa20f3470167e5427a7e7a7cdcd25f0b6b045ae8577cd3e345
MD5 hash:
f62ab5d3528d5a3b9e270ea1f9347868
SHA1 hash:
6a74e87711c615adbd9145f829a33f55b7e42dd6
Link:
https://www.unpac.me/results/f03c2ff0-52ef-45e1-881e-d8c9aa6d2058/
SH256 hash:
5baccdcd2956925b6280da41dbd94b190336e599b5f6f4bd1a1ed3d7ba9ca94a
MD5 hash:
e837ba78eda076c383676dfdb9846d36
SHA1 hash:
051b616366ae1b263cf3e4ce96bc07004469b383
Link:
https://www.unpac.me/results/f03c2ff0-52ef-45e1-881e-d8c9aa6d2058/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/5baccdcd2956/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/5baccdcd2956925b6280da41dbd94b190336e599b5f6f4bd1a1ed3d7ba9ca94a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/196573/

Comments