MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c552c070f43c3ee4c3d278163d4082aebd1697261a8209396efe32673ed0f64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c552c070f43c3ee4c3d278163d4082aebd1697261a8209396efe32673ed0f64
SHA3-384 hash: aa1b3dfa897f9a326904a9720de443f1d0303786f2a95da145d67ff020ddefc8e908cb5b25791bcc258248ab6d8262ca
SHA1 hash: 19e1932547fe32c423c5f57adf7cd36df96b3b2d
MD5 hash: 1aeb4a3096a3bb07468160d0110c7e5b
humanhash: fifteen-fanta-hawaii-floor
File name:Doc_987945678.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:842'752 bytes
First seen:2021-05-20 12:52:01 UTC
Last seen:2021-05-20 13:05:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:BP9QnFDArigD2VoaSD5K1GjFiRUIJ8jYZ:t9QnIDGI5KgxxIJ
Threatray 5'068 similar samples on MalwareBazaar
TLSH 5405C06E715EAA04E4FC973684D9C03062BB9C979261D63F38E5355F0BB27ED019AB03
Reporter TeamDreier
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://www.virustotal.com/vtapi/v2/file/download?apikey=bc2c21d3811ca7c91a0ecaf91d44485a8114658f3f3cd61aff614cc17559b41b&hash=6038925ad826c47f4380440ecc4609bc8123f8cf44a0497da6cbe6b090bfaf15
Verdict:
Malicious activity
Analysis date:
2021-05-17 13:33:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/08c6f87b-53bf-4488-b78e-d40f95416748

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/159621/
Detection(s):
SecuriteInfo.com.Scr.Malcodegdn30.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/786198
Signature
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to register a low level keyboard hook
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 418595 Sample: Doc_987945678.exe Startdate: 20/05/2021 Architecture: WINDOWS Score: 100 51 mail.spamora.net 2->51 61 Found malware configuration 2->61 63 Antivirus detection for dropped file 2->63 65 Antivirus / Scanner detection for submitted sample 2->65 67 10 other signatures 2->67 8 Doc_987945678.exe 7 2->8         started        12 MLdAu.exe 5 2->12         started        14 MLdAu.exe 4 2->14         started        signatures3 process4 file5 41 C:\Users\user\AppData\Roaming\OcCUvq.exe, PE32 8->41 dropped 43 C:\Users\user\...\OcCUvq.exe:Zone.Identifier, ASCII 8->43 dropped 45 C:\Users\user\AppData\Local\...\tmpA017.tmp, XML 8->45 dropped 47 C:\Users\user\...\Doc_987945678.exe.log, ASCII 8->47 dropped 69 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->69 71 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->71 73 Contains functionality to register a low level keyboard hook 8->73 81 2 other signatures 8->81 16 Doc_987945678.exe 2 9 8->16         started        21 schtasks.exe 1 8->21         started        75 Antivirus detection for dropped file 12->75 77 Multi AV Scanner detection for dropped file 12->77 79 Machine Learning detection for dropped file 12->79 23 schtasks.exe 1 12->23         started        25 MLdAu.exe 2 12->25         started        27 schtasks.exe 14->27         started        29 MLdAu.exe 14->29         started        signatures6 process7 dnsIp8 49 mail.spamora.net 185.26.106.194, 49736, 49737, 49738 ATE-ASFR France 16->49 37 C:\Users\user\AppData\Roaming\...\MLdAu.exe, PE32 16->37 dropped 39 C:\Users\user\...\MLdAu.exe:Zone.Identifier, ASCII 16->39 dropped 53 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->53 55 Tries to steal Mail credentials (via file access) 16->55 57 Tries to harvest and steal ftp login credentials 16->57 59 3 other signatures 16->59 31 conhost.exe 21->31         started        33 conhost.exe 23->33         started        35 conhost.exe 27->35         started        file9 signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c552c070f43c3ee4c3d278163d4082aebd1697261a8209396efe32673ed0f64/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-17 08:45:28 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lrksybypipb64tb5e6awhvaiflv5c2lsmgucbe4w57rsm47nb5sa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0667e8d86f7a7a1dea0ef5f68c3ed168580dfd2b2754186284806d41b337cb22
AgentTesla
371793ef15c6e1d0b0ab0edf326d4ab60ba5ce8cf26676fcc1ebd6329a23e914
AgentTesla
45c22ef191a04d054c8a9e4f873c8ccfe34527944da8c9f60dbb656c7a1dd30e
AgentTesla
7c49ac4366eb07c5e5a146356908ba9e2e7e1bb2630422821f93530f0e2ec2ed
AgentTesla
88d6342ccae8c8af4195bcb8c8d41230821ff2d1d5d559e074e240d903af840d
AgentTesla
afe5f231da8522e65cc2bf585ffe774154ccf5f4781eec508d8c30129ae0c3bf
AgentTesla
d6b54e921467dd688dc63b3019654168fd7e72fb0b902e9b08f8c0c3337af388
AgentTesla
dda72a8446e835b1f1bfa71e271a45695ba68b2ce5846553893ba2d4b0291dde
AgentTesla
fe0fb21a7669d885fee457ce696d2a5096da1a9b4bcfe6e06b5f0d58ac4a12f2
AgentTesla
feb639dabb33ddc8d08dc3065a7a869225419d52be2aa0ec247377607a426ef3
AgentTesla
+ 5'058 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210520-g73zn5y3j6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5c552c070f43c3ee4c3d278163d4082aebd1697261a8209396efe32673ed0f64

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/159621/

Comments