MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60d1370a6be9757d7c17dde38c1b092d70fa3bfc4d26a2f9548b095a2c714fb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60d1370a6be9757d7c17dde38c1b092d70fa3bfc4d26a2f9548b095a2c714fb7
SHA3-384 hash: 055c9bf712c9f3c50579163d8a35f457523598a63a33906dfca235ffdbf994a4bcdef631bed206026dacdf128437890d
SHA1 hash: 6af325ef6e0ed11e5799595c9b204167b6c9ae8e
MD5 hash: c40c375df4fdab891cb5a03953d68d38
humanhash: apart-undress-louisiana-cold
File name:IP copy.pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'231'360 bytes
First seen:2023-03-03 21:52:43 UTC
Last seen:2023-03-06 07:33:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:d2MOEAlI3MzSSV93762p/nVyFraLxNbZlYy88r6vrWjWTAOvaEIn3YwG6LSm:dlYdSSn62mGLxzlYL8r2XTpahaCL
Threatray 67 similar samples on MalwareBazaar
TLSH T16F45A82809FC0AF24571F1FD9FE4E753BE8488E6AB049D99C2838B89555385720AFD3D
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
254
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
IP copy.pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-03-03 21:53:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ec1b014a-ef9b-4ee9-8d55-6638f6e611a8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/371554/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64026c3f0e8ce4beca258eb9/reports/beae1195-28f6-48e1-a2b7-62dfea6efa5d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/60d1370a6be9757d7c17dde38c1b092d70fa3bfc4d26a2f9548b095a2c714fb7
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/893821a0-c157-4ba2-a1da-5c1a4e22a39c
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1186930
Signature
Adds a directory exclusion to Windows Defender
Initial sample is a PE file and has a suspicious name
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 819806 Sample: IP copy.pdf.exe Startdate: 03/03/2023 Architecture: WINDOWS Score: 100 54 Sigma detected: Scheduled temp file as task from temp location 2->54 56 Multi AV Scanner detection for submitted file 2->56 58 Yara detected AgentTesla 2->58 60 8 other signatures 2->60 7 KrAvjTiceRzAD.exe 5 2->7         started        11 IP copy.pdf.exe 7 2->11         started        process3 dnsIp4 42 192.168.2.1 unknown unknown 7->42 62 Multi AV Scanner detection for dropped file 7->62 64 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->64 66 May check the online IP address of the machine 7->66 70 2 other signatures 7->70 14 KrAvjTiceRzAD.exe 14 2 7->14         started        18 schtasks.exe 1 7->18         started        34 C:\Users\user\AppData\...\KrAvjTiceRzAD.exe, PE32 11->34 dropped 36 C:\...\KrAvjTiceRzAD.exe:Zone.Identifier, ASCII 11->36 dropped 38 C:\Users\user\AppData\Local\...\tmp5376.tmp, XML 11->38 dropped 40 C:\Users\user\AppData\...\IP copy.pdf.exe.log, ASCII 11->40 dropped 68 Adds a directory exclusion to Windows Defender 11->68 20 IP copy.pdf.exe 15 2 11->20         started        22 powershell.exe 21 11->22         started        24 schtasks.exe 1 11->24         started        26 SgrmBroker.exe 11->26         started        file5 signatures6 process7 dnsIp8 44 mail.eventcenter.am 14->44 46 api.ipify.org 14->46 72 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->72 74 Tries to steal Mail credentials (via file / registry access) 14->74 76 Tries to harvest and steal browser information (history, passwords, etc) 14->76 28 conhost.exe 18->28         started        48 api4.ipify.org 104.237.62.211, 443, 49698, 49702 WEBNXUS United States 20->48 50 eventcenter.am 176.118.167.73, 49699, 49703, 587 ARVID-LOGICUMEE Russian Federation 20->50 52 2 other IPs or domains 20->52 78 Installs a global keyboard hook 20->78 30 conhost.exe 22->30         started        32 conhost.exe 24->32         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60d1370a6be9757d7c17dde38c1b092d70fa3bfc4d26a2f9548b095a2c714fb7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-03-03 17:22:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
16 of 25 (64.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mditoctl5f2x27ax3xryygyjfvypuo74jutkf6kurmevuldrj63q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
15852a249bf70514a6c961426ec261dff37d2a6bf8588d6f9775b8107a8c973f
AgentTesla
3047d199e9540948a25c577cc9181b77d26708c2539c660706a8fd12fec2db1b
AgentTesla
34ee1f687542eedbad8004e9f6861d4842497c08d5374bf6ea50a8af633ebc22
AgentTesla
478dba764af2f0d8179f62518b9d675cec897722b4bc9dc75b5bf66cbca0b9a0
AgentTesla
79477d248daad8ef7e2470ec40e066f55e945d343b8bfe778359646b34182d91
AgentTesla
b8a5c75c1d6e7d0db7108bdace410c3eb76455a5458f885abb52ff543d5bcaf9
AgentTesla
bc547f7978f4abebf31a6659ba9715abdad0b345f725d63bfe4429b868bc5113
AgentTesla
c551529018bda5ce4f1f7c2fbbebad88a1544151676521feb0bb5fcacc4a48be
AgentTesla
c89d8cc3c52b8b56669289df85876ab472b3451e459f18cfd35d7f74e24dc8fd
AgentTesla
e1332c9ff034ded7f31b405f082cba3f67c5bf23f679e08643907ff26679cbfb
AgentTesla
+ 57 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230303-1rl9aaba5t/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
3ca25565f727620bf66870b7a7ddc1ff4dcfab3379364c72a1230e3939ccdab0
MD5 hash:
e6bd21572c1af518e36aeec8dd54ea47
SHA1 hash:
de008f94b96996ddd6f7f5d6094f9e5cf772e584
Link:
https://www.unpac.me/results/22564b25-2b89-445c-82ef-1219201cafd3/
SH256 hash:
cfde9fbe911ac54095876a70d5a743bb5bfcee2b3835c680088dbeb7b3b38133
MD5 hash:
2b9bc769cdc416460e3b0cd05ae5a803
SHA1 hash:
d669d19178860c3fba31bcadfe9fc33a8f1f7549
Link:
https://www.unpac.me/results/22564b25-2b89-445c-82ef-1219201cafd3/
SH256 hash:
1bab001c090f2f208e39247f8eeaeb77a0740bc9be7fa755cd57a863b3d22dd3
MD5 hash:
90b3109cf9cc5342015fc1583a78b282
SHA1 hash:
bdddff1c96296a0dc9f8d808e3b2d5829a15d2d2
Link:
https://www.unpac.me/results/22564b25-2b89-445c-82ef-1219201cafd3/
SH256 hash:
d06df7395d561e198f9b7c5481567116ff2e4c2e84437c018d2a2c8ea6c4ca37
MD5 hash:
0fb6061f7d37424fb9e6d0e76b019c19
SHA1 hash:
98a64bf7b459f032d6ec5793003bf61b5ae1dd74
Link:
https://www.unpac.me/results/22564b25-2b89-445c-82ef-1219201cafd3/
Parent samples :
495607b1aef01bf7dfb64b5cb16a8fc0f161c2923627d71c69de97328f8eca3f
2434aa78b46a3afc98fa6e888c3eb56278ba52b0ff800e7e875af9c2e7f9011a
SH256 hash:
76c395bd3492421e1ce097be9e0c783ca1ac93fcfa3e2b277dda1fccd1c91fd0
MD5 hash:
28cc695000674d7fadaee55d32c80f1c
SHA1 hash:
0f6e178313fd51ef1f2d05a29faad12873da6867
Link:
https://www.unpac.me/results/22564b25-2b89-445c-82ef-1219201cafd3/
SH256 hash:
60d1370a6be9757d7c17dde38c1b092d70fa3bfc4d26a2f9548b095a2c714fb7
MD5 hash:
c40c375df4fdab891cb5a03953d68d38
SHA1 hash:
6af325ef6e0ed11e5799595c9b204167b6c9ae8e
Link:
https://www.unpac.me/results/22564b25-2b89-445c-82ef-1219201cafd3/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/60d1370a6be9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/60d1370a6be9757d7c17dde38c1b092d70fa3bfc4d26a2f9548b095a2c714fb7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 4112bd3de7cac9b1a3d8dad44a2be94f61e77bed714dcb1b4916629252e27345

AgentTesla

Executable exe 60d1370a6be9757d7c17dde38c1b092d70fa3bfc4d26a2f9548b095a2c714fb7

(this sample)

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/371554/
  
Dropped by
SHA256 4112bd3de7cac9b1a3d8dad44a2be94f61e77bed714dcb1b4916629252e27345
  
Dropped by
MD5 bce3fbd01692cdbe41f7b6ea53c72bca

Comments