MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ccceb53c4aa4ba94c752be82593545b0df736cc1cb98b6647fc4a7e7f6706b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 16

Intelligence 16 IOCs YARA 4 File information Comments 1

SHA256 hash:	5ccceb53c4aa4ba94c752be82593545b0df736cc1cb98b6647fc4a7e7f6706b1
SHA3-384 hash:	a69df1d0c682550077c39ca164c78198ca84c3cb8a13e116fee68e80b4d033e04e6909362791578a8a8c7749471de71e
SHA1 hash:	13cc93cd06fa3b56554df46e421d8e038e1e1c89
MD5 hash:	cded6466e243c80d6db3b1d30a5ecd7c
humanhash:	one-fifteen-fix-cardinal
File name:	cded6466e243c80d6db3b1d30a5ecd7c
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	215'040 bytes
First seen:	2022-09-16 07:58:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	3072:TU8IbqHpFa+CjugSLSPbKomuqUeFncj6IH+ITKvbS8hiX2Zen9bV9oahE+:g8f5LSmJUeFnW6IeJe8/Ze5Vya
Threatray	18'957 similar samples on MalwareBazaar
TLSH	T186241B7E17855D41CAEE41BD90B2915811F1E703C32AB38F6EE248ED1B162CEF92A9D1
TrID	61.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.0% (.SCR) Windows screen saver (13101/52/3) 8.8% (.EXE) Win64 Executable (generic) (10523/12/4) 5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter	zbetcheckin
Tags:	32 AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

305

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

avemaria

ID:

File name:

http://81.161.229.110/htdocs/

Verdict:

Malicious activity

Analysis date:

2022-09-15 10:12:07 UTC

Tags:

opendir loader trojan stealer rat avemaria arkei warzone formbook agenttesla keylogger remcos evasion snake asyncrat redline

Link:

https://app.any.run/tasks/65e4db7f-bc1d-4a5f-b1a2-8663106abb0d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/310473/

Detection(s):

Win.Malware.Generic-9950504-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Reading critical registry keys

Сreating synchronization primitives

DNS request

Creating a window

Stealing user critical data

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

hacktool packed

Link:

https://www.filescan.io/uploads/63242d091183046074a66f2b/reports/2095c468-32c5-47dc-bb2f-593f41af2c40/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/55f2a868-309b-4a77-8946-5ae895e6eadd

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1071472

Signature

.NET source code contains very large array initializations

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected AgentTesla

Yara detected Generic Downloader

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/5ccceb53c4aa4ba94c752be82593545b0df736cc1cb98b6647fc4a7e7f6706b1/

Threat name:

ByteCode-MSIL.Infostealer.DarkStealer

Status:

Malicious

First seen:

2022-09-16 07:59:06 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

23 of 26 (88.46%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ltgowu6evjf2stdvfpucle2ulmg7onwmds4ywzsh7rfh473ha2yq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

2062091ea3279a8954439ab8e4ea0433b5ba01247554bd02943958645cc6275c

AgentTesla

2c390aefff5a51f2efb72d4e72b85c033b2d0d5f8f5be7063da2703a8474dc11

AgentTesla

7df2d256518cec4656c0ab236d2b26e2d7976382ab75eb0326b5b8c463a6821d

AgentTesla

8bf77994fb5759f8be8d739cd651531fda75de8888c7f579ccafbbadb3b3decb

AgentTesla

af2d0ca2587ed48734a72e365f3106c49c5c48cf23c273e404bf7c87ef2a8a54

AgentTesla

b64081fc4a7dc5e73ab017b1f0453c27d5e6040134dd269bc01de45cad3713b7

AgentTesla

b789ea800e24253ead1c150643aa729e7b7d5253bf6319aa4321680c615b8ec2

AgentTesla

c25d169ffffb762f002d4f6bfe9fda71abfbc60baec3f1d3d813b81a84af0c26

AgentTesla

+ 18'947 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/220916-jvdmwafag7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

outlook_office_path

outlook_win_path

Accesses Microsoft Outlook profiles

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Malware Config

C2 Extraction:

https://api.telegram.org/bot1884223853:AAFBJYLvV6hrzs4P4_W7nhkr0P8noC6MWKI/sendDocument

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/f019289b-c51c-49d0-a5df-2427a5b89271

Unpacked files

SH256 hash:

5ccceb53c4aa4ba94c752be82593545b0df736cc1cb98b6647fc4a7e7f6706b1

MD5 hash:

cded6466e243c80d6db3b1d30a5ecd7c

SHA1 hash:

13cc93cd06fa3b56554df46e421d8e038e1e1c89

Link:

https://www.unpac.me/results/6fb89c44-7fbb-4192-94e7-14ce3962c90f/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5ccceb53c4aa/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5ccceb53c4aa4ba94c752be82593545b0df736cc1cb98b6647fc4a7e7f6706b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.