MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d44448d9368f5ec2b3594446bca10ae98f173176a4e9a55fd239c3c6d9c6edd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d44448d9368f5ec2b3594446bca10ae98f173176a4e9a55fd239c3c6d9c6edd
SHA3-384 hash: 18380192032771622d8731263e29be0f135e7027c7a0c4435dc21763222faea658ada1c4836339658e717fa7b7aedb7c
SHA1 hash: d82411456a13dbacb62ef72bcf392b5648709f69
MD5 hash: 12cf6c125a22c65b0e515dfbfc73cd61
humanhash: delta-speaker-undress-eighteen
File name:Enquire_#29032022.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:487'352 bytes
First seen:2022-03-29 08:43:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (719 x GuLoader, 451 x Formbook, 295 x Loki)
ssdeep 12288:EN1NWRwWcI2Mwomfyvw0l8OwxPBcLDNTd4FqR0:EN1NbWcI2MwomfyvwyuQxTxR0
Threatray 19'677 similar samples on MalwareBazaar
TLSH T14DA46C07398089DCDE6A81F7B617818433D9D8BED25CA7087BC873935EE1FA14826B57
File icon (PE):PE icon
dhash icon a2a88c8ece8ece6e (1 x AgentTesla)
Reporter pr0xylife
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
230
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/259077/
Detection(s):
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.23410.32735.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Reading critical registry keys
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/11963/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6242c6d31f20423948495ff9/reports/f9c9ab1e-8a1c-478a-909c-454217062d02/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/78c1dd96-b1b2-4aa7-b188-a9b40b497c07
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/966666
Signature
.NET source code contains very large array initializations
Changes security center settings (notifications, updates, antivirus, firewall)
Detected unpacking (creates a PE file in dynamic memory)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 599155 Sample: Enquire_#29032022.exe Startdate: 29/03/2022 Architecture: WINDOWS Score: 100 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 2 other signatures 2->45 7 Enquire_#29032022.exe 18 2->7         started        10 svchost.exe 2->10         started        13 svchost.exe 1 1 2->13         started        16 5 other processes 2->16 process3 dnsIp4 29 C:\Users\user\AppData\Local\...\lgawpga.exe, PE32 7->29 dropped 18 lgawpga.exe 7->18         started        63 Changes security center settings (notifications, updates, antivirus, firewall) 10->63 21 MpCmdRun.exe 1 10->21         started        37 127.0.0.1 unknown unknown 13->37 file5 signatures6 process7 signatures8 47 Multi AV Scanner detection for dropped file 18->47 49 Detected unpacking (creates a PE file in dynamic memory) 18->49 51 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 18->51 53 3 other signatures 18->53 23 lgawpga.exe 2 5 18->23         started        27 conhost.exe 21->27         started        process9 dnsIp10 31 akinaluminyum.com.tr 5.180.186.11, 49768, 587 DBT-ASTR Turkey 23->31 33 mail.akinaluminyum.com.tr 23->33 35 x1.i.lencr.org 23->35 55 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 23->55 57 Tries to steal Mail credentials (via file / registry access) 23->57 59 Tries to harvest and steal ftp login credentials 23->59 61 Tries to harvest and steal browser information (history, passwords, etc) 23->61 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d44448d9368f5ec2b3594446bca10ae98f173176a4e9a55fd239c3c6d9c6edd/
Threat name:
Win32.Infostealer.DarkStealer
Create hunting rule
Status:
Malicious
First seen:
2022-03-29 08:44:07 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lvcejdmtnd26ykzvsrcgxsqqv2mpc4yxnjhjuvp5eoody3m4n3oq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
91db81cd38b9f713767e35c4012057b99734e8e0e889af77935c6a0b47eedcbb
AgentTesla
ce6df966091d0a4c305d5629d789f7ed072d01b8b4559d6356ed1643454e2427
AgentTesla
dbea1423f0bad7f114b89acccbecb9f1df6deffb838f7a83cb660fb03b11ac28
AgentTesla
defbeba113680db4e014a2b34be77a64529d1e0d5fb837e732eec92b842d364d
AgentTesla
f403d42973ac773f89be5f033e0ab6268e0078dda5dca6301ccd4924fbe9ec76
AgentTesla
faf88b54daf7749226c2bf5fc4d0f122d728f689093c926f26c1d4b2c275f137
AgentTesla
+ 19'667 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220329-km5l3aghgm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla
Unpacked files
SH256 hash:
7d5473f76dfaf357338667ad63a7224c787104af64be638c013d72fac778c854
MD5 hash:
e52046eb772f44fb4bd6582440f71707
SHA1 hash:
6b6191c273dc02d0a58abef3209070d127f1a2c7
Link:
https://www.unpac.me/results/57d63404-1606-4ab0-8f0c-f2ba66242f4c/
SH256 hash:
2b06b62a45f95fa516c6ac80cf12a6e01278e782934defabc341707c78829382
MD5 hash:
e025d92a4ec888b16de0c66a86599e90
SHA1 hash:
47f41212501153b7b6af0009138cd2963f2594b0
Link:
https://www.unpac.me/results/57d63404-1606-4ab0-8f0c-f2ba66242f4c/
SH256 hash:
a59d93f676d5ade712ef37d1ea4c3bcd097d34bd2fec453a02e8d1a9ffce5d4d
MD5 hash:
98328d12c0f0ff6ddd3b4235a6ca7629
SHA1 hash:
cdac439e9ddc42f5dc69ddfbd70e5e94f74d1fb2
Link:
https://www.unpac.me/results/57d63404-1606-4ab0-8f0c-f2ba66242f4c/
SH256 hash:
5d44448d9368f5ec2b3594446bca10ae98f173176a4e9a55fd239c3c6d9c6edd
MD5 hash:
12cf6c125a22c65b0e515dfbfc73cd61
SHA1 hash:
d82411456a13dbacb62ef72bcf392b5648709f69
Link:
https://www.unpac.me/results/57d63404-1606-4ab0-8f0c-f2ba66242f4c/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/5d44448d9368/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5d44448d9368f5ec2b3594446bca10ae98f173176a4e9a55fd239c3c6d9c6edd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/259077/

Comments