MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 604c5713efcae0dfa43aced2c14082eb92558484caf074a1b2f340de7c717912. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 604c5713efcae0dfa43aced2c14082eb92558484caf074a1b2f340de7c717912
SHA3-384 hash: 822754badbecf85909cb60f80f4630ecac6e1ac32d9356e522c6098d80d225ac9c5e442ed2e1670b9a62a55af6c20b3c
SHA1 hash: 1e1cd3540e316b9a521e68c820a9759b5d332e23
MD5 hash: b45a685ba118b084e076fe9069bfdb0d
humanhash: king-jig-cola-river
File name:QpoPdeSX59bqwnF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:749'056 bytes
First seen:2020-09-22 13:37:20 UTC
Last seen:2020-09-22 15:06:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:o1TPsAK54fJkrWEm0Zux8Y8nMdyCu+mmPKMjALadKBARK1uqz:6e9o0Q6NnayCdPKMjALadYOKsqz
Threatray 78 similar samples on MalwareBazaar
TLSH 8AF4E1353A8C9F82D47C67B88060015063F9EC37E313DA5ABEF531DA5A71B828773A56
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/64397/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.435.24438.24155.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a process with a hidden window
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/472413
Signature
.NET source code contains potential unpacker
Contains functionality to register a low level keyboard hook
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 288649 Sample: QpoPdeSX59bqwnF.exe Startdate: 22/09/2020 Architecture: WINDOWS Score: 100 35 Found malware configuration 2->35 37 Multi AV Scanner detection for dropped file 2->37 39 Sigma detected: Scheduled temp file as task from temp location 2->39 41 9 other signatures 2->41 7 QpoPdeSX59bqwnF.exe 7 2->7         started        process3 file4 21 C:\Users\user\AppData\...\jHrHcvZKNj.exe, PE32 7->21 dropped 23 C:\Users\...\jHrHcvZKNj.exe:Zone.Identifier, ASCII 7->23 dropped 25 C:\Users\user\AppData\Local\...\tmp4BC3.tmp, XML 7->25 dropped 27 C:\Users\user\...\QpoPdeSX59bqwnF.exe.log, ASCII 7->27 dropped 43 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->43 45 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->45 47 Contains functionality to register a low level keyboard hook 7->47 49 Injects a PE file into a foreign processes 7->49 11 QpoPdeSX59bqwnF.exe 15 2 7->11         started        15 schtasks.exe 1 7->15         started        17 QpoPdeSX59bqwnF.exe 7->17         started        signatures5 process6 dnsIp7 29 mail.thanhphet.asia 192.185.113.157, 49746, 587 UNIFIEDLAYER-AS-1US United States 11->29 31 elb097307-934924932.us-east-1.elb.amazonaws.com 54.235.182.194, 443, 49745 AMAZON-AESUS United States 11->31 33 2 other IPs or domains 11->33 51 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->51 53 Tries to steal Mail credentials (via file access) 11->53 55 Tries to harvest and steal ftp login credentials 11->55 57 2 other signatures 11->57 19 conhost.exe 15->19         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/604c5713efcae0dfa43aced2c14082eb92558484caf074a1b2f340de7c717912/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-09-22 01:55:40 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mbgfoe7pzlqn7jb2z3jmcqec5ojflbeezlyhjins6nan47drpeja._file
Verdict:
suspicious
Similar samples:
19b7ae6956a38825ac143952843f6e046c642a9dc635e18d4f84dcff4568c142
AgentTesla
277848fe676c925becc15a494855ccbc42ee8e2e88cf61144d7de703c82250a0
AgentTesla
608593a7eff00bb35776f51d9a95f6cc9eedf0725067cbfae466a2d3ae3da083
AgentTesla
74a2af0c19a872a5230b71224613e6c873056ba409c2e9d1b3c89a6ba3619000
AgentTesla
8bc0a287e7c20feba8e4006c7683503eeabfa9fddfb14c8f80d8a92ef09b6fd6
AgentTesla
93d22d39577ab983c75badd9019b57420a4e2bfc300d6a37d90885d823396058
AgentTesla
c3372683261b447261620810696af6f9f7250ec7022b82c81895051039effcbd
AgentTesla
d98f8380522e71c61b91d1fbdf98c0528fc20388a85695529824754f00a183a1
AgentTesla
dc4eaa151b01375e0ba2392396b60e6abebab99e5590c93ab23ee3063aba5eb5
AgentTesla
f03aa3254a964c676c99d1b2e96ef0e84d4c81e3b0885debf8e49f731c3d4779
AgentTesla
+ 68 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/200922-9w8wxzbd66/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/604c5713efcae0dfa43aced2c14082eb92558484caf074a1b2f340de7c717912

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/64397/

Comments