MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 660618df19d3cb8275659686a82d840f748ac7d1f31c974af715cc77b8c737d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 660618df19d3cb8275659686a82d840f748ac7d1f31c974af715cc77b8c737d7
SHA3-384 hash: 7680594d45b4a8ac28b4017bc828ad0ea2791fb67911ecb3c990265ca644278814550f71f11046cdbacccabdff16e820
SHA1 hash: a11e8f73d2a01ad6ee8a8df6f400c2baa571ba33
MD5 hash: 5ab0a977c3e88aff0244e376275f1487
humanhash: ceiling-autumn-ten-single
File name:payment_copy_banca_mediolanum.pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:74'240 bytes
First seen:2021-12-01 09:18:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'754 x AgentTesla, 19'660 x Formbook, 12'252 x SnakeKeylogger)
ssdeep 1536:naA02xQLlr1vg7rI4Ob+OLhlLDJ3eJG53G73mxdvd4:naA02Ktg7rI4ObLhlLl32GhNvi
Threatray 13'688 similar samples on MalwareBazaar
TLSH T13E737D01F6A49660C7EA07B764DAE10CD3FA882E0227D956FCD43E8C16327D61DF166E
File icon (PE):PE icon
dhash icon 64e4c8d0f0e8d4d4 (56 x AgentTesla, 7 x RemcosRAT, 5 x NanoCore)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
payment_copy_banca_mediolanum.pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-12-01 09:22:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/479dce56-13c9-41cf-8efc-a64a6fd52e8e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/210231/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
DNS request
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61a73e081ba903dd8fc8bc26/reports/67cd44f2-f6f6-4920-9ee4-66893bdea9f9/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Quasar RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ca2cdb04-a0ed-484a-a72c-719163a98f7f
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/899271
Signature
Executable has a suspicious name (potential lure to open the executable)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses ping.exe to check the status of other devices and networks
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 531749 Sample: payment_copy_banca_mediolan... Startdate: 01/12/2021 Architecture: WINDOWS Score: 88 33 Found malware configuration 2->33 35 Yara detected AgentTesla 2->35 37 Uses an obfuscated file name to hide its real file extension (double extension) 2->37 39 4 other signatures 2->39 8 payment_copy_banca_mediolanum.pdf.exe 15 3 2->8         started        process3 dnsIp4 31 buysrilankan.lk 98.142.107.146, 443, 49810 DIMENOCUS United States 8->31 11 powershell.exe 9 8->11         started        14 powershell.exe 8 8->14         started        process5 signatures6 41 Uses ping.exe to check the status of other devices and networks 11->41 16 PING.EXE 1 11->16         started        18 MpCmdRun.exe 1 11->18         started        20 conhost.exe 11->20         started        22 PING.EXE 1 14->22         started        25 conhost.exe 14->25         started        process7 dnsIp8 27 conhost.exe 16->27         started        29 192.168.2.1 unknown unknown 22->29 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/660618df19d3cb8275659686a82d840f748ac7d1f31c974af715cc77b8c737d7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-12-01 09:19:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mydbrxyz2pfye5lfs2dkqlmeb52ivr6r6mojosxxcxghpoghg7lq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3db4b03593267b847f05a09d5005bae2570b4d08b60ae7619770de2f47ddf734
AgentTesla
58223934638d3e88fc8740a0f509c24191b797b32f5e41b152a3b26ede01fe81
AgentTesla
78af4e9c1f31817ce195cd77aea8659a75148c5a302b35e9c17f2ff93a696a0c
AgentTesla
9122c256e01d8489721f5a124686ad014bb32fb9d058dc74d966d36381fe01c8
AgentTesla
939a5a4e939c613c997bcbef470b2e3c201bba37a83127a6545219cfec9640a9
AgentTesla
cd21f313637dcce24e8ca5cb45937fcbaeade384bb435e215e6abcee06e44757
AgentTesla
dabff599f798510f8acfc9067feddde27050ed506d55adfac28cc2f938574002
AgentTesla
e762700a619f80536189a18a44dab017f8583150011cb146f31fae72d7acc1ff
AgentTesla
+ 13'678 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/211201-k97d6sebh6/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
660618df19d3cb8275659686a82d840f748ac7d1f31c974af715cc77b8c737d7
MD5 hash:
5ab0a977c3e88aff0244e376275f1487
SHA1 hash:
a11e8f73d2a01ad6ee8a8df6f400c2baa571ba33
Link:
https://www.unpac.me/results/24534541-93b2-4122-98b8-e6b30c5beb61/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/660618df19d3cb8275659686a82d840f748ac7d1f31c974af715cc77b8c737d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 660618df19d3cb8275659686a82d840f748ac7d1f31c974af715cc77b8c737d7

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/210231/

Comments